Potential fix for https://github.com/DevExpress/DevExtreme/security/code-scanning/353

To fix this, add rate limiting middleware to the Express app and apply it to the routes that trigger the expensive file-system operations (demoIndexHandler). The most straightforward way, consistent with the background example, is to use the well-known express-rate-limit package. This keeps existing functionality (same handler logic and routes) while enforcing a maximum number of requests per client in a time window, reducing DOS risk from repeated calls to readFileSync and readdirSync.

Concretely:

• In apps/demos/utils/server/csp-server.js, require express-rate-limit near the other require calls.
• Configure a limiter instance with a reasonable window and max value; since this is a demo server, a generic configuration (e.g., 100 requests per 15 minutes per IP) is acceptable and mirrors the background example.
• Apply the limiter as middleware specifically for the demo routes, not globally, to avoid changing behavior of unrelated endpoints. For example, define const demoIndexLimiter = RateLimit({...}) and then change the route definitions to app.get('/apps/demos/...', demoIndexLimiter, demoIndexHandler);.
• No changes are needed inside demoIndexHandler itself; only the route wiring is updated.

All changes are limited to the shown file and keep existing behavior aside from introducing rate limiting on the risky endpoints.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.