Update axios and lodash to address reported vulnerabilities (#1621)

- Bump axios from ^1.13.2 to ^1.15.0 to patch GHSA-fvcv-3m26-pcqx
  (unrestricted cloud metadata exfiltration via header injection)
  and GHSA-3p68-rc4w-qgx5 (NO_PROXY hostname normalization bypass
  leading to SSRF).
- Bump lodash from ^4.17.21 to ^4.17.24 to patch GHSA-r5fr-rjxr-66jc
  (code injection via _.template) and GHSA-f23m-r3pf-42rh (prototype
  pollution via array path bypass in _.unset and _.omit).
- Add an explicit overrides entry for follow-redirects ^1.15.12 to
  clear GHSA-r4q5-vmmm-2653 (custom authentication headers leaked to
  cross-domain redirect targets). axios 1.15.0 still pins
  follow-redirects@1.15.11, which is the upper bound of the
  vulnerable range; the override pulls in 1.16.0.

npm audit now reports 0 vulnerabilities. All unit tests, lint, and
prettier checks pass.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: snowping

npm-shrinkwrap.json

@@ -89,7 +89,7 @@
   "dependencies": {
     "ajv": "^8.17.1",
     "antlr4": "^4.13.2",
-    "axios": "^1.13.2",
+    "axios": "^1.15.0",
     "chalk": "^4.1.2",
     "commander": "^13.1.0",
     "fhir-package-loader": "^2.2.3",
@@ -99,7 +99,7 @@
     "https-proxy-agent": "^7.0.5",
     "ini": "^5.0.0",
     "junk": "^3.1.0",
-    "lodash": "^4.17.21",
+    "lodash": "^4.17.24",
     "readline-sync": "^1.4.10",
     "sanitize-filename": "^1.6.3",
     "sax": "^1.5.0",
@@ -110,5 +110,8 @@
     "valid-url": "^1.0.9",
     "winston": "^3.19.0",
     "yaml": "^1.10.2"
+  },
+  "overrides": {
+    "follow-redirects": "^1.15.12"
   }
 }