Upgrade execa dependency to reduce security risk

[whaber]

Project depends on 0.7.0 which has a vulnerability (OS Command Injection in execa)

Upgrade dependency to latest version https://www.npmjs.com/package/execa/v/4.0.3

[veeara282]

This was identified by GitLab, so NPM can't create an advisory for it due to copyright. I say we should still see where execa is used in this app and make sure the vulnerability can't be exploited.

From the GitLab advisory:

Attackers could trick execa into executing arbitrary binaries. This behaviour is caused by the setting preferLocal=true which makes execa search for locally installed binaries and executes them.

We should be able to resolve this by upgrading to 2.0.0 or later.

[colbymorrison]

Execa is not used by any of our direct dependencies, only dev-dependencies. So, this is not an urgent issue.