chore(deps): bump lodash to fix Dependabot alerts

[aterga]

Summary

• Adds pnpm override for lodash@<4.18.0 → ^4.18.1, resolving 2 Dependabot alerts:
  • lodash — high (refactor: orbit folder structure #218): code injection via _.template imports key names
  • lodash — medium (fix: increase upgrader canister creation retry period #217): prototype pollution via _.unset and _.omit

Notes

• Alert docs: add orbit glossary #201 (rustls-webpki 0.102.8) remains open — constrained by ic-agent@0.38.2, requires a major ic-agent version upgrade to resolve

Test plan

• pnpm install completes successfully
• Lockfile contains lodash@4.18.1 (no more 4.17.21)
• CI pipeline passes

🤖 Generated with Claude Code