Update lodash-amd to v4.17.21 + edadd45 (#6064)

* Fix prototype pollution in _.set and related functions

Prevents setting dangerous properties (__proto__, constructor, prototype)
that could lead to prototype pollution vulnerabilities.

* Fix command injection vulnerability in _.template

- Add validation for the variable option to prevent injection attacks
- Improve sourceURL whitespace normalization to prevent code injection

* Fix cyclic value comparison in _.isEqual

Properly checks both directions when comparing cyclic values to ensure
correct equality comparisons for circular references.

* Improve _.sortBy and _.orderBy performance and array handling

- Add early return for empty arrays in sorted index operations
- Improve array iteratee handling to support nested property paths
- Add missing keysIn import in baseClone

* Refactor _.trim, _.trimEnd, and _.trimStart implementations

Extract shared trim logic into reusable utilities (_baseTrim, _trimmedEndIndex)
for better code organization and consistency. Update related functions
(toNumber, parseInt) to use new utilities. Improve comment accuracy.

* Add documentation for predicate composition with _.overEvery and _.overSome

Enhance documentation to show how _.matches and _.matchesProperty can be
combined using _.overEvery and _.overSome for more powerful filtering.
Add examples demonstrating shorthand predicate syntax.

* Bump to v4.17.21

* Fix prototype pollution in _.unset and _.omit

Prevent prototype pollution on baseUnset function by:
- Blocking "__proto__" if not an own property
- Blocking "constructor.prototype" chains (except when starting at primitive root)
- Skipping non-string keys

See: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg

* Update JSDoc documentation to align with main branch

- Fix sortBy example ages (40 -> 30) for correct sort order demonstration
- Fix _setCacheHas return type (number -> boolean)

_baseUnset.js

@@ -1,5 +1,11 @@
 define(['./_castPath', './last', './_parent', './_toKey'], function(castPath, last, parent, toKey) {
 
+  /** Used for built-in method references. */
+  var objectProto = Object.prototype;
+
+  /** Used to check objects for own properties. */
+  var hasOwnProperty = objectProto.hasOwnProperty;
+
   /**
    * The base implementation of `_.unset`.
    *
@@ -10,8 +16,47 @@ define(['./_castPath', './last', './_parent', './_toKey'], function(castPath, la
    */
   function baseUnset(object, path) {
     path = castPath(path, object);
-    object = parent(object, path);
-    return object == null || delete object[toKey(last(path))];
+
+    // Prevent prototype pollution, see: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
+    var index = -1,
+        length = path.length;
+
+    if (!length) {
+      return true;
+    }
+
+    var isRootPrimitive = object == null || (typeof object !== 'object' && typeof object !== 'function');
+
+    while (++index < length) {
+      var key = path[index];
+
+      // skip non-string keys (e.g., Symbols, numbers)
+      if (typeof key !== 'string') {
+        continue;
+      }
+
+      // Always block "__proto__" anywhere in the path if it's not expected
+      if (key === '__proto__' && !hasOwnProperty.call(object, '__proto__')) {
+        return false;
+      }
+
+      // Block "constructor.prototype" chains
+      if (key === 'constructor' &&
+          (index + 1) < length &&
+          typeof path[index + 1] === 'string' &&
+          path[index + 1] === 'prototype') {
+
+        // Allow ONLY when the path starts at a primitive root, e.g., _.unset(0, 'constructor.prototype.a')
+        if (isRootPrimitive && index === 0) {
+          continue;
+        }
+
+        return false;
+      }
+    }
+
+    var obj = parent(object, path);
+    return obj == null || delete obj[toKey(last(path))];
   }
 
   return baseUnset;