[node-core-library] Remove lodash from production packages; add Objects.mergeWith and Objects.isRecord

[iclanton]

Summary

Removes lodash as a runtime dependency from all production packages in this repo that were using it, replacing usages with native JavaScript equivalents or new utilities added to @rushstack/node-core-library.

Two new utilities are added to the Objects namespace in node-core-library:

• Objects.isRecord(value) — type guard that narrows unknown to Record<string, unknown> (non-null, non-array object)
• Objects.mergeWith(target, source, customizer?) — recursive deep-merge modelled after lodash's mergeWith, with an optional customizer function

Details

Packages affected:

• @rushstack/node-core-library: Added Objects.isRecord (in isRecord.ts) and Objects.mergeWith + Objects.MergeWithCustomizer (in mergeWith.ts), both exported from the Objects namespace. Unit tests added for mergeWith.

• @microsoft/api-extractor: Replaced lodash.mergeWith with Objects.mergeWith and lodash.cloneDeep with structuredClone (safe since the data is JSON-serializable and Node ≥ 18 is required).

• @rushstack/heft-jest-plugin: Replaced lodash mergeWith/isObject with Objects.mergeWith/Objects.isRecord.

• @rushstack/npm-check-fork: Replaced _.extend with Object.assign, _.has with Object.prototype.hasOwnProperty.call, and a lodash chain with native Object.keys().filter().sort().

• @rushstack/localization-plugin-test-02 (build test): Replaced lodash.escape with a small inline htmlEscape helper, since HTML escaping was the only usage.

Test fixtures: References to lodash as a stand-in package in Rush test fixtures (ProjectChangeAnalyzer tests, repoWithCatalogs, sandbox repos, integration tests) were replaced with semver, which is already in the dependency graph and serves the same stand-in purpose.

No backwards-incompatible changes. Objects.mergeWith and Objects.isRecord are new additions.

How it was tested

• heft build passes in all affected projects (node-core-library, api-extractor, heft-jest-plugin, npm-check-fork).
• New unit tests for Objects.mergeWith cover: target mutation, primitive overwrite, recursive plain-object merge, array overwrite (no index merge), null handling, empty objects, and customizer behaviour (return value, undefined fallback, argument passing, array concat, key enumeration, nested fallback).
• API Extractor review file updated to reflect the new public API surface.