Update dependencies to mitigate CVE

[rdebeasi]

hoek 4.2.0 and earlier are vulnerable to a prototype pollution attack. This PR brings in a minor update to request, which now uses hoek 4.2.1 instead of 4.2.0. (See this line in pakage-lock.json for confirmation of the version number.)

GitHub will still complain about 4.2.1, but this is apparently a false positive. Only 4.2.0 and earlier are affected.

[rdebeasi@rdebeasi infographic]$ npm ls hoek
infographic@1.0.0 /home/rdebeasi/Projects/infographic
└─┬ request@2.85.0
  └─┬ hawk@6.0.2
    ├─┬ boom@4.3.1
    │ └── hoek@4.2.1  deduped
    ├─┬ cryptiles@3.1.2
    │ └─┬ boom@5.2.0
    │   └── hoek@4.2.1  deduped
    ├── hoek@4.2.1 
    └─┬ sntp@2.1.0
      └── hoek@4.2.1  deduped

CC @oybed

[oybed]

LGTM