Fix security issue with javascript dependencies

[mwcraig]

See github's alert: https://github.com/vpython/vpython-jupyter/network/alert/labextension/vpython/package-lock.json/lodash.mergewith/open

[mwcraig]

And another one: https://github.com/vpython/vpython-jupyter/network/alert/labextension/vpython/yarn.lock/ws/open

[mwcraig]

This ended up being fixed by #26 -- thanks again, @kdunn926!