[Security upgrade] bump multer 2.1.1 -> 2.2.0 (web + clsi) (#34916)

GHSA-72gw-mp4g-v24j / CVE-2026-5079 — DoS via deeply nested field names,
patched in 2.2.0. multer is a direct dep of web and clsi (file uploads).

- bump multer to 2.2.0 in services/web and services/clsi
- re-target the Overleaf local patch (attach files with no filename as
  'undefined' instead of skipping) from 2.1.1 to 2.2.0, kept as a scoped
  root resolution to match the repo's patch convention

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 0d10137b521ebaacee71fc41adba32c4530a4041

.yarn/patches/multer-npm-2.2.0-4ed181c78f.patch

@@ -1,8 +1,8 @@
 diff --git a/lib/make-middleware.js b/lib/make-middleware.js
-index ee50988..de77364 100644
+index 2c15f248d4f4d221bd9e2b2e1092b8d5c46d2bdd..f2bceb4479c94e321d4882ca1fe09c3ad280cca7 100644
 --- a/lib/make-middleware.js
 +++ b/lib/make-middleware.js
-@@ -164,7 +164,7 @@ function makeMiddleware (setup) {
+@@ -174,7 +174,7 @@ function makeMiddleware (setup) {
        if (fieldname == null) return abortWithCode('MISSING_FIELD_NAME')
  
        // don't attach to the files object, if there is no file