set-value security fix

[bergren2]

• bump Webpack so we're working with similar dependencies down the road
• upgrade Snapdragon as a dependency so it's using a patched version of set-value
• bump Webpack CLI so the builds work again

[bergren2]

Okay, this has been an open issue for years: nickmerwin/node-coveralls#80

Noticed a Microsoft team (microsoft/vscode-python#6340) focused on making sure the builds still passed even if sending to Coveralls failed, and then eventually switched to Codecov. Another option is to switch off of Travis CI. I'd advocate for a similar approach.