Bump lodash to >= 4.18.0 via npm override

Add npm override for lodash to resolve CVE-2026-4800 (Code Injection
via \_.template imports key names).

Closes github/vuln-mgmt#192979

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Copilot

package-lock.json

@@ -10,10 +10,15 @@
     "lint": "eslint descriptions/**/*.json --ext .json"
   },
   "eslintConfig": {
-    "extends": ["plugin:json/recommended"]
+    "extends": [
+      "plugin:json/recommended"
+    ]
   },
   "devDependencies": {
     "eslint": "^8.13.0",
     "eslint-plugin-json": "^3.1.0"
+  },
+  "overrides": {
+    "lodash": ">=4.18.0"
   }
 }