Upgrade lodash to ^4.17.15 to eliminate vulnerability

[TonyJDavies]

This would resolve #1151 to eliminate the npm vulnerability Prototype Pollution identified by https://www.npmjs.com/advisories/1065.

[coveralls]

Coverage remained the same at 97.419% when pulling 0befd73 on TonyJDavies:master into e94e2e7 on istanbuljs:master.

[coreyfarrell]

Note this will not have any effect on your own installations and will not directly result in a new release. This will only fix npm audit messages that would occur when developing/testing nyc itself.

Our production dependency on lodash is installed via semver-range from babel, so nyc@14.1.1 will install the latest non-vulnerable version of lodash assuming you do not have a package-lock.json or yarn.lock blocking it. If you do have a package-lock.json then you need to run npm audit fix from your own project. I do not know the equivalent command to update yarn.lock.