Update glob-parent where we can

Unfortunately we can't do them all.

* storybook still has some deps. One they [removed in "next"][2].
  Another is still there. Plus it has some webpack 4 deps it seemingly
  doesn't actually use.
* `gulp` devs [actively refuse to update dependencies][3] when they
  believe they're not hitting the vulnerability, apparently as protest
  against `npm audit` which they consider "broken".

[2]: storybookjs/storybook#15174
[3]: gulpjs/glob-stream#108