Fix dependabot alerts

[devonpis]

the PR created by the dependabot has error on building, probably having difficulty to access the nexus registry.

Therefore I try to fix various vulnerabilities reported by dependabot manually.
and here are the findings:

• all the vulnerabilities should have no effects on the production code, as either are devDependencies or unuse.
• vulnerabilities from formiojs package will not be fixed, even we update our dependencies (from the moment package https://github.com/qld-gov-au/formio/security/dependabot/12), as we are serving the compiled formiojs script files. it has to be fixed in future release in formiojs repo.
• vulnerability from postcss https://github.com/qld-gov-au/formio/security/dependabot/8 will be fixed by removing the glob support for scss import.
• there is no walkaround for vulnerability from scss-tokenizer, since it's a devDependencies (from node-sass package), it would not affect the production code so could be dismissed.

[devonpis]

follow up: formio/formio.js#4768

[duttonw]

should this not be 1.18.x?