Bump lodash and surge

Bumps [lodash](https://github.com/lodash/lodash) to 4.17.21 and updates ancestor dependency [surge](https://github.com/sintaxi/surge). These dependencies need to be updated together.


Updates `lodash` from 4.17.10 to 4.17.21
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.10...4.17.21)

Updates `surge` from 0.20.1 to 0.23.1
- [Release notes](https://github.com/sintaxi/surge/releases)
- [Commits](sintaxi/surge@v0.20.1...v0.23.1)

---
updated-dependencies:
- dependency-name: lodash
  dependency-type: indirect
- dependency-name: surge
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <[email protected]>