Potential fix for code scanning alert no. 26: Missing rate limiting

[farrukhishaq]

Potential fix for https://github.com/UKHomeOffice/aspel-workspace/security/code-scanning/26

Add an Express rate-limiting middleware to this reports router so requests to GET /:report are capped per client/IP over a time window.
Best fix: use express-rate-limit and apply it before the route handler (router.use(limiter)), so both streaming and non-streaming database paths are covered in one change without altering existing business logic.

File to change

• packages/asl-metrics/lib/reports/index.js

What to add

1. Import express-rate-limit.
2. Define a limiter instance (for example 100 requests per 15 minutes).
3. Attach it to this router before router.get('/:report', ...).

This addresses both alert variants since both DB accesses happen inside the same route.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.