fix(srcclr): Update package-lock.json to satisfy SourceClear (#215)

## Summary
SourceClear seems to install `lodash@4.17.10` per our package-lock.json, rather than installing `lodash@4.17.11` (the latest) as they might if installing directly via npm. Update package-lock.json to mitigate this.

Preserve `"lodash": "^4.0.0"` in package.json so that our customers remain free to control their lodash subdependencies.

## Issues
- OASIS-4112

Author: nchilada