Bump lodash from 4.17.4 to 4.18.1 in /javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingMergeCall/src-vulnerable-lodash

Bump lodash from 4.17.4 to 4.18.1 in /javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingMergeCall/src-vulnerable-lodash #14