Update upload-server dependencies

Multer 1.4.4 carried multiple high-severity DoS advisories (and a
transitive one in dicer). It turns out multer hasn't actually been used
since the server was rewritten as a React SPA in 2022 (upload/download
now happens via a raw PUT body parsed with express.raw()) - so it's
removed.

All other dependencies of `upload-server` were bumped to their latest
version, including also an Express 4 -> 5 upgrade.

Author: vogelsgesang