mitigate GHSA-qwcr-r2fm-qrc7 (backport #7146) [release/4.8.x]

[mergify]

Handle audit failures:
body-parser: GHSA-qwcr-r2fm-qrc7
path-to-regexp: GHSA-9wv6-86v2-598j

Packages updated:
sinon -> ^18.0.1
body-parser -> ^1.20.3
express -> ^4.20.0
fetch-mock -> ~11.1.3

Working with @tcobbs-bentley to resolve the failing ios tests after upgrade. Seems to be a unicode issue related to this change in path-to-regexp. Working theory (from Travis):

it looks like both ID_Start and ID_Continue are special regex tokens. I found the following, and I'm not sure if it's related or not: https://stackoverflow.com/questions/71155109/invalid-regular-expression-invalid-property-name-in-character-class. Digging further, it looks like this regex will only work with full ICU (International Components for Unicode). The mobile build of Node does not have this (and probably cannot have it any time soon).

Also upgrade actions/upload-artifact@v2 -> actions/upload-artifact@v4 since v2 is no longer supported. This task is used in our extract-api action.

We'll get this through to unblock builds and take another look tomorrow.

---

This is an automatic backport of pull request #7146 done by [Mergify](https://mergify.com).

[mergify]

Cherry-pick of 9f4c8a4 has failed:

On branch mergify/bp/release/4.8.x/pr-7146
Your branch is up to date with 'origin/release/4.8.x'.

You are currently cherry-picking commit 9f4c8a4bab.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   .github/workflows/extract-api.yaml
	new file:   common/changes/@itwin/appui-abstract/mitigate-various-audit-failures_2024-09-11-17-04.json
	new file:   common/changes/@itwin/certa/mitigate-various-audit-failures_2024-09-11-17-04.json
	new file:   common/changes/@itwin/core-backend/mitigate-various-audit-failures_2024-09-11-17-04.json
	new file:   common/changes/@itwin/core-frontend/mitigate-various-audit-failures_2024-09-11-17-04.json
	new file:   common/changes/@itwin/core-quantity/mitigate-various-audit-failures_2024-09-11-17-04.json
	new file:   common/changes/@itwin/ecschema-editing/mitigate-various-audit-failures_2024-09-11-17-04.json
	new file:   common/changes/@itwin/ecschema-locaters/mitigate-various-audit-failures_2024-09-11-17-04.json
	new file:   common/changes/@itwin/ecschema-metadata/mitigate-various-audit-failures_2024-09-11-17-04.json
	new file:   common/changes/@itwin/express-server/mitigate-various-audit-failures_2024-09-11-17-04.json
	new file:   common/changes/@itwin/frontend-tiles/mitigate-various-audit-failures_2024-09-11-17-04.json
	new file:   common/changes/@itwin/map-layers-auth/mitigate-various-audit-failures_2024-09-11-17-04.json
	new file:   common/changes/@itwin/map-layers-formats/mitigate-various-audit-failures_2024-09-11-17-04.json
	new file:   common/changes/@itwin/presentation-backend/mitigate-various-audit-failures_2024-09-11-17-04.json
	new file:   common/changes/@itwin/presentation-common/mitigate-various-audit-failures_2024-09-11-17-04.json
	new file:   common/changes/@itwin/presentation-frontend/mitigate-various-audit-failures_2024-09-11-17-04.json
	modified:   core/backend/package.json
	modified:   core/ecschema-editing/package.json
	modified:   core/ecschema-locaters/package.json
	modified:   core/ecschema-metadata/package.json
	modified:   core/express-server/package.json
	modified:   core/frontend/package.json
	modified:   core/quantity/package.json
	modified:   extensions/frontend-tiles/package.json
	modified:   extensions/map-layers-auth/package.json
	modified:   extensions/map-layers-auth/src/test/ArcGisAccessClient.test.ts
	modified:   extensions/map-layers-formats/package.json
	modified:   extensions/map-layers-formats/src/test/ArcGisFeature/ArcGisFeatureProvider.test.ts
	modified:   full-stack-tests/backend/package.json
	modified:   full-stack-tests/core/package.json
	modified:   full-stack-tests/presentation/package.json
	modified:   presentation/backend/package.json
	modified:   presentation/common/package.json
	modified:   presentation/frontend/package.json
	modified:   test-apps/display-performance-test-app/package.json
	modified:   test-apps/display-test-app/package.json
	modified:   tools/certa/package.json
	modified:   ui/appui-abstract/package.json

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   common/config/rush/pnpm-config.json
	both modified:   common/config/rush/pnpm-lock.yaml
	both modified:   full-stack-tests/rpc/package.json

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally