In 91b8839 @abernix updated package-lock for `@types/express` (something I had
also noted happened on a branch I was working on). Soon after, in #4327, that
line got dropped from package-lock.json.

I'm guessing this caused the issue I started seeing soon afterwards, where I'd
get lots of compile errors relating to `@types/express` and other
DefinitelyTyped packages it depends on. Turns out the dependencies from
`@types/express` are unversioned, but the latest versions of that type package
depends on the latest versions of a bunch of other type packages.

This commit seems to fix things for me.

- We don't directly depend on `@types/express-serve-static-core`, so I don't
  quite understand the addition of those.  I seem to not have the flapping
  of deps without adding it!

- We shouldn't need to package the `@types/qs` (or the aforementioned pkg)
  into the `apollo-server-express` package's non-dev deps because none of
  those types are exported from our emitted `d.ts` files.  Those
  dependencies should be brought by the corresponding packages if there are
  transitive dep needs.