fix(deps): upgrade vulnerable lodash, picomatch, and defu (#8146)

#### Summary

ensure all production dependencies are free of known vulnerabilities.

with this patch, it's back to 0 vulnerabilities:

```sh
$ npm audit --omit=dev
found 0 vulnerabilities
```

Author: AviVahl

package-lock.json

@@ -123,7 +123,7 @@
     "jwt-decode": "4.0.0",
     "lambda-local": "2.2.0",
     "locate-path": "8.0.0",
-    "lodash": "4.17.23",
+    "lodash": "4.18.1",
     "log-update": "7.2.0",
     "maxstache": "1.0.7",
     "maxstache-stream": "1.0.4",