fix: package.json to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/npm:lodash:20180130

Latest report for strongloop/loopback-boot:
https://snyk.io/test/github/strongloop/loopback-boot

package.json

@@ -27,7 +27,7 @@
     "async": "~0.9.0",
     "commondir": "0.0.1",
     "debug": "^2.0.0",
-    "lodash": "^3.6.0",
+    "lodash": "^4.17.5",
     "semver": "^4.1.0",
     "strong-globalize": "^2.6.2",
     "toposort": "^0.2.10"