feat: upgrade postcss-values-parser to version without high risk vulnererability

[davilima6]

See

• https://www.npmjs.com/advisories/1550
• https://github.com/shellscape/postcss-values-parser/issues/120

[davilima6]

Tests fail for Node 8:

$ npm test
> postcss-custom-properties@9.1.1 test /home/travis/build/postcss/postcss-custom-properties
> npm run test:js && npm run test:tape
> postcss-custom-properties@9.1.1 test:js /home/travis/build/postcss/postcss-custom-properties
> eslint src/{*,**/*}.js --cache --ignore-path .gitignore --quiet
> postcss-custom-properties@9.1.1 pretest:tape /home/travis/build/postcss/postcss-custom-properties
> rollup -c .rollup.js --silent
> postcss-custom-properties@9.1.1 test:tape /home/travis/build/postcss/postcss-custom-properties
> postcss-tape
/home/travis/build/postcss/postcss-custom-properties/node_modules/is-url-superb/index.js:11
    } catch {
            ^
SyntaxError: Unexpected token {
    at createScript (vm.js:80:10)
    at Object.runInThisContext (vm.js:139:10)
    at Module._compile (module.js:617:28)
    at Object.Module._extensions..js (module.js:664:10)
    at Module.load (module.js:566:32)
    at tryModuleLoad (module.js:506:12)
    at Function.Module._load (module.js:498:3)
    at Module.require (module.js:597:17)
    at require (internal/module.js:11:18)
    at Object.<anonymous> (/home/travis/build/postcss/postcss-custom-properties/node_modules/postcss-values-parser/lib/nodes/Word.js:12:15)
npm ERR! code ELIFECYCLE

Would you mind if we added package-lock.json ?

[Semigradsky]

@davilima6 postcss-values-parser 4.x has breaking changes: Node v10+ now required

[davilima6]

Would you mind dropping support for Node 8?

[Semigradsky]

We will do it in next major version with Postcss 8 support

[davilima6]

I see, so what is your suggestion for this PR/fix? Should it wait for such next major?

[Semigradsky]

Hm, I will publish new major version. Why not

[Semigradsky]

https://github.com/postcss/postcss-custom-properties/releases/tag/10.0.0