Update information about the latest security updates

[bjohansebas]

Several security updates have been made since version 4.16.0 of Express, it would be good to update this information.

page: https://expressjs.com/en/advanced/security-updates

cc: @expressjs/security-triage @expressjs/security-wg

[UlisesGascon]

I transferred the issue for visibility

[bjohansebas]

Should we include the updates that Herodevs patches? I'm talking about the vulnerabilities that have been patched by Herodev in Express 3.

[ljharb]

They’re not fixed in any public express version, so i’m not sure it makes sense in that list - but certainly indicating that a specific unfixed CVE is patched by a third party seems useful.