fix(srcclr): Update package-lock.json to satisfy SourceClear (#215)

## Summary
SourceClear seems to install `[email protected]` per our package-lock.json, rather than installing `[email protected]` (the latest) as they might if installing directly via npm. Update package-lock.json to mitigate this.

Preserve `"lodash": "^4.0.0"` in package.json so that our customers remain free to control their lodash subdependencies.

## Issues
- OASIS-4112

Author: nchilada