chore!: Fix dependency security issues

[tomauth0]

Description

• Resolves all critical and high npm-audit issues by updating dependancies:
  • xml-crypto (1.5.3 -> 2.0.0) This version removes support for HMAC by default, which is unsupported by this library - security fix
  • saml (0.15.0-rc.0 -> 1.0.0) Removes support for node <v10 - security fix
  • Dev dependancies:
    • express (3.11.0 -> 4.17.1) Major release that changes API footprint - security fix, removes support for node <v10
    • mocha (1.8.1 -> 8.2.1) Major release that changes API footprint - security fix, removes support for node <v10
    • Locks cheerio-select version to fix test issues.
    • Small refactor of server.js to support newer express version.

BREAKING CHANGE: This removes support for node versions 4, 6 & 8 - newer versions of mocha use async/await, causing tests to fail in older versions.

References

Addressing Issues:
#106
#107

Addressing issues resolved in other PRs:
#109

Testing

No functional changes introduced

• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not master

[luuuis]

LGTM. Ideally the CHANGELOG.md would be updated after merging into master and when making the first release from there.

[ziluvatar]

I can see major upgrades on xml-crypto (direct dependency + saml dependency) and xml-encryption (saml dependency).

Could you mention what were the breaking changes in those libs? Would they affect the consumers of this library in any way (just in case we need to modify README with migration steps or similar)