chore(deps): patch critical prototype and URL dependencies

[infeng]

After the GitHub critical-alert fixes, npm audit still identifies critical prototype-pollution and URL parsing dependencies in the legacy development tree. Refresh Lodash 4, mixin-deep, set-value, union-value, jsprim/json-schema and url-parse within their existing parent ranges. Remove the unused react-test-render development package, the remaining owner of Lodash 3; the regression suite uses Enzyme and its separate react-test-renderer dependency.

The refreshed versions are lodash 4.18.1, mixin-deep 1.3.2, set-value 2.0.1, union-value 1.0.1, jsprim 1.4.2/json-schema 0.4.0, and url-parse 1.5.10. npm also deduplicates their obsolete nested copies. There are no application-source changes.

Validation:

• Repository search found no use of react-test-render beyond its manifest/lock entry.
• Clean public-registry install and full npm run verify passed: 42 viewer tests, lint, library/demo/SSR builds, package export and hydration checks, multipart regression and package dry run.
• npm audit's critical package count dropped from 9 to 2; the remaining two entries are the EJS/bundle-analyzer chain, handled separately.
• git diff --check passed.