fix: FORMS-1303 add main location to package.json

Added the "main" setting with a value of "app.js" to the package.json. This is to hopefully influence the CodeQL static checks to recognize the rate limiter applied to all API routes.

app/package.json

@@ -1,5 +1,6 @@
 {
   "name": "common-hosted-form-service-app",
+  "main": "app.js",
   "version": "1.5.0",
   "private": true,
   "license": "Apache-2.0",