Change lodash to caret semver range

[karlhorky]

User facing changelog

Change lodash to use caret semver range due to frequent security issues.

Additional details

This allows consumers to update lodash versions to address security issues without using special tools like Yarn Resolutions or npm overrides. Since lodash is a volatile package in regards to security updates, this seems like a good tradeoff to make.

This changes the Renovate configuration originally specified by @bahmutov in #2992

Renovate rangeStrategy Docs:
https://docs.renovatebot.com/configuration-options/#rangestrategy

How has the user experience changed?

• Users can update lodash without updating cypress
• Bots such as Dependabot can do this automatically

PR Tasks

None applicable.

┆Issue is synchronized with this Jira Features by Unito

[cypress-bot]

Thanks for taking the time to open a PR!

• Create a Draft Pull Request if your PR is not ready for review. Mark the PR as Ready for Review when you're ready for a Cypress team member to review the PR.
• Become familiar with the Code Review Checklist for guidelines on coding standards and what needs to be done before a PR can be merged.

[jennifer-shehane]

As noted before, will have to bring this up to discuss with the team, if we want to change this strategy. #7921 (comment)

[karlhorky]

Ok, I suspected this may be something going in the "strategy discussion" direction.

To provide an example for the discussion, here wp-calypso has a lodash pull request with mergeStrategy: 'bump':

Automattic/wp-calypso#43928

[jennifer-shehane]

@karlhorky Our team has decided that this is a change we would like to make. The body of work is a bit larger than is covered here in this PR, since there are some stickier things with version control going on when we build the binary. So, I've created a new issue to outline the work necessary. #8046 We'll have a new PR to address the full changes, so I'll be closing this one.

Thanks for bringing this up! I think it helped get the ball rolling on things.

[karlhorky]

Thanks for the update @jennifer-shehane, sounds good. Glad to help :)