Small dependency bump

[mcab]

The goal of this PR is to get things to a "working state."

We want to get coverage and unit tests in a good state (they run) before doing any additional changes.

This allows us to revert if necessary.

[mcab]

❯ npm audit
                                                                                
                       === npm audit security report ===                        
                                                                                
# Run  npm install xml-crypto@2.0.0  to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Improper Key Verification                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ xml-crypto                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ xml-crypto                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ xml-crypto                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1583                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ uglify-js                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.6.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ jscoverage [dev]                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ jscoverage > uglify-js                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/48                              │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ debug                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >= 2.6.9 < 3.0.0 || >= 3.1.0                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ jscoverage [dev]                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ jscoverage > debug                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/534                             │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.2.1 <1.0.0 || >=1.2.3                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ jscoverage [dev]                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ jscoverage > optimist > minimist                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 4 vulnerabilities (3 low, 1 high) in 139 scanned packages
  1 vulnerability requires semver-major dependency updates.
  3 vulnerabilities require manual review. See the full report for details.

Without adding jscoverage, we would only have to address xml-crypto, which should be addressed with #215!

The problem is that jscoverage was used, and as an evil necessity, will be here until we can use #198 to replace jscoverage with a newer coverage tool (nyc).

[mcab]

❯ npm i
npm WARN prepublish-on-install As of npm@5, `prepublish` scripts are deprecated.
npm WARN prepublish-on-install Use `prepare` for build steps and `prepublishOnly` for upload-only.
npm WARN prepublish-on-install See the deprecation note in `npm help scripts` for more information.

> saml2-js@2.0.7 prepublish /[...]/Clever/saml2
> make build

make: Nothing to be done for `build'.
npm WARN saml2-js@2.0.7 No license field.

added 138 packages from 158 contributors and audited 139 packages in 1.759s

16 packages are looking for funding
  run `npm fund` for details

found 4 vulnerabilities (3 low, 1 high)
  run `npm audit fix` to fix them, or `npm audit` for details

Turns out, we don't really use npm run prepublish. We can fix this by removing the script all together.

❯ npm i
npm WARN saml2-js@2.0.7 No license field.

added 138 packages from 158 contributors and audited 139 packages in 1.676s

16 packages are looking for funding
  run `npm fund` for details

found 4 vulnerabilities (3 low, 1 high)
  run `npm audit fix` to fix them, or `npm audit` for details