Bump express & socket.io in Node demos to clear Dependabot alerts

Updates the three Node example servers (DrawTogether, RemoteHandWave,
SimpleSlider) from express ^4.17.1 / socket.io ^3.x to express ^4.21.2 /
socket.io ^4.8.1, regenerating lockfiles. This resolves all 42 open
Dependabot alerts (2 critical, 18 high, 12 medium, 10 low), which were
all transitive deps of these two packages (ws, path-to-regexp, qs,
cookie, body-parser, socket.io-parser, send, serve-static, debug).

The socket.io 3->4 bump is API-compatible with the server code here, and
clients load socket.io from the server (/socket.io/socket.io.js), so no
client-side version pinning is affected. npm audit now reports 0
vulnerabilities in all three folders.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jonfroehlich