Patch cacache to 10.0.4 (patches ssri to ^5.2.4)

[EmilNordling]

There's no harm that the know security vulnerability could do, the author specifies it here.

But ever since it's been reviewed, https://nvd.nist.gov/vuln/detail/CVE-2018-7651, as an know security vulnerability all repos that depends on this dependency gets a varning. Angular-cli is one of the bigger one that uses this dependency, and it's also quite common for whoever using Webpack.

The author of cacache seems to have fixed the vulnerability for cacache's 10.0.4 release.

[alexander-akait]

@EmilNordling PR welcome