Bump lodash to 4.17.21

[paulboocock]

We still use lodash in tests. There are two CVEs effecting the version we are using:

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23337
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500