[Security upgrade] bump multer 2.1.1 -> 2.2.0 (web + clsi) (#34916)

GHSA-72gw-mp4g-v24j / CVE-2026-5079 — DoS via deeply nested field names,
patched in 2.2.0. multer is a direct dep of web and clsi (file uploads).

- bump multer to 2.2.0 in services/web and services/clsi
- re-target the Overleaf local patch (attach files with no filename as
  'undefined' instead of skipping) from 2.1.1 to 2.2.0, kept as a scoped
  root resolution to match the repo's patch convention

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 0d10137b521ebaacee71fc41adba32c4530a4041

services/web/package.json

@@ -154,7 +154,7 @@
     "moment": "^2.29.4",
     "mongodb-legacy": "6.1.3",
     "mongoose": "8.22.1",
-    "multer": "2.1.1",
+    "multer": "2.2.0",
     "nocache": "^2.1.0",
     "node-fetch": "^2.7.0",
     "nodemailer": "^8.0.5",