fix: remediate CVE-2025-15284 in qs dependency

Add npm override to pin qs@6.14.1, fixing prototype pollution vulnerability
in query string parsing.

Co-authored-by: Ona <no-reply@ona.com>

Author: ona-security-engineer

backend/catalog/package-lock.json

@@ -2,6 +2,9 @@
   "name": "catalog-service",
   "version": "1.0.0",
   "description": "Catalog service for Gitpod Flix",
+  "overrides": {
+    "qs": "6.14.1"
+  },
   "main": "src/index.ts",
   "scripts": {
     "start": "ts-node src/index.ts",