Fix a few vulnerabilities

Two can not be fixed yet:
- swagger-api/swagger-node#579
- nodejs/node-gyp#1718

Author: Tristramg

src/package.json

@@ -34,7 +34,7 @@
     "async-stacktrace": "0.0.2",
     "channels": "0.0.4",
     "cheerio": "0.20.0",
-    "clean-css": "3.4.19",
+    "clean-css": "4.2.1",
     "cookie-parser": "1.4.3",
     "ejs": "2.6.1",
     "etherpad-require-kernel": "1.0.9",
@@ -49,7 +49,7 @@
     "log4js": "0.6.35",
     "measured-core": "1.11.2",
     "nodeify": "^1.0.1",
-    "npm": "6.4.1",
+    "npm": "6.9.0",
     "object.values": "^1.0.4",
     "request": "2.88.0",
     "resolve": "1.1.7",