Bump the npm_and_yarn group across 1 directory with 4 updates

Bumps the npm_and_yarn group with 4 updates in the / directory: [lodash](https://github.com/lodash/lodash), [brace-expansion](https://github.com/juliangruber/brace-expansion), [flatted](https://github.com/WebReflection/flatted) and [undici](https://github.com/nodejs/undici).


Updates `lodash` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

Updates `brace-expansion` from 1.1.12 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.18)

Updates `flatted` from 3.3.3 to 3.4.4
- [Commits](WebReflection/flatted@v3.3.3...v3.4.4)

Updates `undici` from 5.29.0 to 6.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v5.29.0...v6.28.0)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: flatted
  dependency-version: 3.4.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.28.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>

Author: dependabot[bot]

package-lock.json

@@ -28,7 +28,7 @@
     "@actions/core": "^2.0.2",
     "@iarna/toml": "^2.2.5",
     "globby": "^11.1.0",
-    "lodash": "^4.17.23"
+    "lodash": "^4.18.1"
   },
   "devDependencies": {
     "@vercel/ncc": "^0.38.4",