fix: bump lodash to 4.18.1 to remediate CVE-2026-4800 (#25)

lodash <4.18.0 allows code injection via unsanitised options.imports key
names in _.template(). Fixed in 4.18.0. Resolves ENG-14004.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: andriy-sudo

zapier/package-lock.json

@@ -9,13 +9,13 @@
   "dependencies": {
     "agentql-js-common": "^0.0.1",
     "zapier-platform-core": "^17",
-    "lodash": ">=4.17.23"
+    "lodash": ">=4.18.0"
   },
   "devDependencies": {
     "jest": "^29.6.0"
   },
   "overrides": {
-    "lodash": ">=4.17.23",
+    "lodash": ">=4.18.0",
     "minimatch": "^3.1.3",
     "picomatch": "^2.3.2"
   },