Remove GeoJSON validation

[mourner]

Closes #1051, closes #1020, closes #1049. Upgrades some dependencies to pass security audit, and removes GeoJSON validation which wasn't very useful for its added size, was applied inconsistently, and relied on an unmaintained library with highly vulnerable transitive deps. Removing it is technically not too breaking since the code that worked before will continue working after the upgrade.

[rreusser]

This makes sense to me. Do I understand correctly that users would then be responsible for passing valid geojson? Should we add a note to the docs for add which conveys this?

[mourner]

I think it's fine to not mention — the old validation behavior was never mentioned anyway, and requirement to pass valid GeoJSON is implied in all APIs like this

[davidbeers]

This is great. @mourner do you have a rough idea when there might be a release with this fix? From reading comments it seems like it would make a very welcome minor release all on its own even if there aren't other features or fixes ready to release.

[mourner]

@davidbeers just released!

[murdocha]

Thank you!
this is much better than the work-around I I had found to reference a Github commit by hash in package.json:

    "@mapbox/mapbox-gl-draw": "git+https://github.com/mapbox/mapbox-gl-draw.git#c12fb64b90d00e877e94b12b60bc3b80e42924dd",