package.json: added lodash to dev dependencies

For now it's just a dev dependency necessary to run the webpack management
command and enable custom 3rd party static asset directories, but
eventually it'll replace underscore.