4.x: Upgrade merge-descriptors dependency

[RobinTail]

The line in package.json on that dependency is 9 years old.
There were two patches to that package since then.
Because the dependency version is fixed, it can not be deduplicated if a newer version is also installed by another dependency.
I'm suggesting to allow patches. There should be no harm in it.

[wesleytodd]

Hey, I generally agree with this but need to mention this has historically been the policy of the project:

Dependencies not directly "owned" bu the Express project are pinned.

I think our goal while taking over operations for these packages was to keep mostly the same for the v4 lines and apply new policies going forward in v5. Would you be willing to open two PRs, one to master with just an update to the latest in that major line and one against 5.x with a change to update this to accept incoming minors as well (^ prefix)?

[RobinTail]

okay. I will set 1.0.3 then, @wesleytodd

For the 5.x I suggest using v2, since it requires Node 18 and higher

[RobinTail]

Made another one for v5, @wesleytodd
#5782

[RobinTail]

It's been month this PR is waiting to be merged, @wesleytodd