Use Lodash's _.template instead of lodash.template package

[gorner]

edit: Resolves #10459.

CVE-2021-23337 was recently updated to reflect an issue previously patched in Lodash also being present in the lodash.template package, which from all appearances is no longer maintained. I should emphasize there's nothing I've seen to suggest there's any significant risk in terms of how ember-cli uses this package currently, but it still raises alerts on NPM/GitHub that would be best to clear if possible.

This PR replaces lodash.template with the overall lodash package – which is already a transitive dependency – and substitutes it in the two places where it was being used. I ran the existing tests for these two modules and they passed.

Note that this does not yet fully remove lodash.template from the dependency tree; it is also a dependency of broccoli-concat via sourcemap-validator (v1.1.1) which I intend to raise separately shortly.

Edit: On further review I noticed that the current versioning would accept bumping fast-sourcemap-concat to v2.1.1 and that doing so would remove the lodash.template dependency entirely.

If anything else is needed to ensure this can be back-merged to the LTS versions, please let me know.

[LucasHill]

Lodash has confirmed that @gorner's approach is the recommended resolution.

If possible, we should get this fix into all the currently supported LTS versions, which I believe is back to 4.12 for security patches.

[gorner]

@LucasHill just want to clarify the "recommended resolution" you've linked is a comment I posted, I am not associated with the Lodash project as I said there. I'm not sure where Lodash would have endorsed this as their recommended fix.

[LucasHill]

@gorner sorry I completely missed that and just made some assumptions. It was a well written explanation of what is happening and why projects should stop using the individually published functions.

[kellyselden]

Could you retarget the lts-4-12 branch? Then it will get into all LTS's.

[gorner]

@kellyselden Done

[kellyselden]

Released in 4.12.3, 5.4.2, 5.8.1, and 5.9.0-beta.1. Thanks!