Upgrade argparse dependency

[stefanobaghino-da]

Running npm audit reveals that this package is affected by a security
vulnerability that is described in the following advisory:

• https://nodesecurity.io/advisories/745

Upgrading the dependency to a new version removes the vulnerability for
this package and transitively for all its dependees. I'm addressing this
as part of an effort to get rid of security advisories as advertised by
npm audit from https://github.com/digital-asset/daml-js. I believe the
security risk is very low, but I hoped getting this low hanging fruit
could have been a worthy contribution.

Running npm test seems to reveal no regression despite the potentially
breaking changes introduced by a new major release of the upgraded
dependency.

This contribution also introduces a lockfile. You can read more details
at the following link:

• https://docs.npmjs.com/files/package-locks

[stefanobaghino-da]

How reliable is the CI? eslint seems to be missing but if that's the case I would not understand how this could ever possibly work. I've run the tests locally installing eslint in the global scope because it was missing in the package manifest and expected the CI to follow the same process.

[DannyDainton]

Hey @jonschlinkert,

Would it be possible to take a look at this PR and some of the other security-related ones, please?

Thank you for creating this resource but it's starting to flag up more issues now and I would love to see them gone.

Cheers.

[stefanobaghino-da]

I took some time to go through the recent PRs and opened issues. #312 does the same as this PR. Apologies for opening a duplicate PR. I will close this.

Also related to this issue, #327 would fix the reported advisory by replacing argparse with minimist. This approach has been discussed in #321.