fix(security): bump lodash to ^4.18.0 (GHSA-f23m-r3pf-42rh, GHSA-r5fr-rjxr-66jc, ENG-14276) (#46)

lodash 4.17.23 pulled in via @trivago/prettier-plugin-sort-imports (dev dep).
Override pins to ^4.18.0 (first patched release). Lock resolves to 4.18.1.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: andriy-sudo

package-lock.json

@@ -55,7 +55,8 @@
     },
     "flatted": "^3.4.2",
     "path-to-regexp": "^8.4.0",
-    "picomatch": "^4.0.4"
+    "picomatch": "^4.0.4",
+    "lodash": "^4.18.0"
   },
   "keywords": [
     "mcp",