remove lodash dependency

[bholloway]

Supercedes #5.

• Instead of updating lodash lets just change it out for Object.assign().
• Update dependencies, use exact versions

[bholloway]

@cheesestringer could you pls eyeball this for any silly errors.

There is an unrelated depencency update but they appear to be fairly safe semver jumps. I was planning to just risk it. Really need some automated tests.

I presume you are just using this via resolve-url-loader. However if you are also using the loader proper please let me know if you can test.

[cheesestringer]

Looks good!

Yeah, just consuming it through resolve-url-loader.