Consumers who installed @ui5/cli and ran "npm ci" got:

  npm error Missing: qs@6.15.3 from lock file

The "overrides" entry forced a single qs@6.16.0 across the bundled
express/body-parser tree at pack time. Overrides are producer-only, so
consumers re-resolve without them, expect qs@6.15.3, and the lockfile no
longer matches, breaking "npm ci".

The GHSA-x5fp-wj9c-mxmx / GHSA-4mjr-xmp4-gh2g qs vulnerability that the
override addressed is not applicable to the way express / body-parser use
qs, so removing the override does not expose us to it.

Upstream fixes are in progress but not yet consumable: the qs bumps are
still open pull requests, not merged or released, so we cannot rely on the
transitive dependencies alone yet:

  expressjs/express#7440
  expressjs/body-parser#761

Dropping the override lets qs resolve naturally and keeps package.json and
package-lock.json in sync.