[security] Bump lodash.mergewith from 4.6.1 to 4.6.2

[marcdumais-work]

see: https://github.com/lodash/lodash/issues/4348

Note: at first I thought I would attempt to also cover the update of lodash.template in this PR, but:

• this is only a dev-dependency, that's not used in production, so somewhat less of a concern
• going down the rabbit hole, we would have to update to lerna: 3.x, which is a big change, that I do not have time to tackle ATM

I'll post a separate draft PR for lodash.template

[marcdumais-work]

Note: this is a minor production dependency update, for which we usually do not need to do anything special, IP-wise. I have still confirmed that the new version still looks good, license-wise, by checking their GH repo.

[vince-fugnitto]

It looks good to me, the CI passes and it's a micro version update (bug fix)
Also, it looks like the deprecated @theia/extension-manager is the one pulling it through the sanitize-html dependency.

[akosyakov]

ok, since it is not a runtime dependency

[marcdumais-work]

ok, since it is not a runtime dependency

@akosyakov actually this one is technically a runtime dependency, though as noted by @vince-fugnitto it's pulled from the extension manager, which is deprecated. Does that change your approval of this PR?

[akosyakov]

no, the extension manager should not be used by anyone