fix: incorrectly traversing of object with length property

[argos83]

@whitlockjc Swagger-tools had the same bug than json-refs (lodash .each behavior on objects with a length property) whitlockjc/json-refs#129

this PR:

• fixes the buggy use of .each on objects
• pins the json-ref dependency to the fixed version
• includes a test that will pass right away when the fix is in place or will timeout and fail if there's ever a regression (I couldn't find a more direct way of testing this fix using the public api)

[googlebot]

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed, please reply here (e.g. I signed it!) and we'll verify. Thanks.

---

• If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.
• If your company signed a CLA, they designated a Point of Contact who decides which employees are authorized to participate. You may need to contact the Point of Contact for your company and ask to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the project maintainer to go/cla#troubleshoot. The email used to register you as an authorized contributor must be the email used for the Git commit.
• In order to pass this check, please resolve this problem and have the pull request author add another comment and the bot will run again. If the bot doesn't comment, it means it doesn't think anything has changed.

[argos83]

CLA signed (I couldn't find a mention to this CLA thing in the contributors guide)

[googlebot]

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for the commit author(s). If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google.
In order to pass this check, please resolve this problem and have the pull request author add another comment and the bot will run again. If the bot doesn't comment, it means it doesn't think anything has changed.

[argos83]

CLA signed again with my other email address

[googlebot]

CLAs look good, thanks!

[BenSayers]

@whitlockjc is there anything blocking this PR from being merged? It's a small bugfix and has been well tested.

[BenSayers]

@whitlockjc thanks for merging. Can you please release this so we can consume the fix?

[whitlockjc]

I'll see what I can do.

[BenSayers]

@whitlockjc bump