Issue title: JS dependencies stale in new project, triggering security alerts
 Issue body: ### Environment

* Elixir version (elixir -v): _Elixir 1.9.0 (compiled with Erlang/OTP 22)_
* Phoenix version (mix deps): _phoenix 1.4.10 (Hex package) (mix)_
* NodeJS version (node -v): _v12.10.0_
* NPM version (npm -v): _6.11.3_
* Operating system: _Arch Linux_

### Expected behavior

1. Creating a new phoenix project and uploading it to github will not show any JS security vulnerabilities from their automated scanner.
2. (Debatable) All `package.json` should be at the latest major version; that is, in the `X.Y.Z` versioning scheme the `X` should be the same as the latest released version. (Or Y, if X=0).

### Actual behavior

1. A new phoenix project uploaded to github triggers 3 security alerts from javascript packages.
  -  Two from `js-yaml`, which needs to be >= `3.13.1` to be safe.  (WS-2019-0032, WS-2019-0063)
  - One from `mem`, which needs to be >= `4.0.0` to be safe. ( WS-2018-0236 )

Two are severity medium (memory leak, dos) and one is severity high (arbitrary code execution).

These aren't specified directly in the package.json, so they have parent projects that need to be upgraded instead.  `mem` is being pulled in by `webpack-cli`.  `js-yaml` is being pulled in by `optimize-css-assets-webpack-plugin`.

2. These packages are outdated by a major version:
```
Package                            Current Wanted Latest Package Type    URL                                                       
copy-webpack-plugin                4.6.0   4.6.0  5.0.4  devDependencies https://github.com/webpack-contrib/copy-webpack-plugin    
css-loader                         2.1.1   2.1.1  3.2.0  devDependencies https://github.com/webpack-contrib/css-loader             
mini-css-extract-plugin            0.4.5   0.4.5  0.8.0  devDependencies https://github.com/webpack-contrib/mini-css-extract-plugin
optimize-css-assets-webpack-plugin 4.0.3   4.0.3  5.0.3  devDependencies http://github.com/NMFR/optimize-css-assets-webpack-plugin 
uglifyjs-webpack-plugin            1.3.0   1.3.0  2.2.0  devDependencies https://github.com/webpack-contrib/uglifyjs-webpack-plugin
webpack-cli                        2.1.5   2.1.5  3.3.8  devDependencies https://github.com/webpack/webpack-cli#readme             
```
Not a major version, but several minor versions behind:
```
Package                            Current Wanted Latest Package Type    URL                                                       
webpack                            +1-312-251-4853 devDependencies https://github.com/webpack/webpack                        
```

 Comments: 
 Comment 0: > These aren't specified directly in the package.json, so they have parent projects that need to be upgraded instead.

As this is outside of our control, closing since we need to wait on changes from the affected libraries. However, If you are aware of non-transitive dep updates that will resolve some of the warnings, please send a PR. If minor versions are not available, major version changes will need thoroughly tested to make sure we are still in working states across Mac/windows/linux. Thanks!

 Comment 1: I don't believe there are any changes from libraries we need to wait for.  The fixes are out there, but we're not getting them due to the versions of libraries phoenix is requesting.  I suppose it's possible for package maintainers to backport security fixes to previous major versions, but I don't think it's often done in JS land.

I tested, and these changes remove the vulnerabilities:
```
-    "optimize-css-assets-webpack-plugin": "^4.0.0",
+    "optimize-css-assets-webpack-plugin": "^5.0.3",
```
Upgrades `js-yaml` from `3.7.0` to `3.13.1`, a version with the vulnerabilities fixed.

```
-    "webpack-cli": "^2.0.10"
+    "webpack-cli": "^3.3.8"
```
Upgrades `mem` from `1.1.0` to `4.3.0`, a version with the vulnerabilities fixed.

I'll send PRs for each, but I will need help testing, I don't really know how to go about it.

 Comment 2: I'd love PRs for those! Testing wise, we only need to ensure that the watcher run out of the box by phx.server (`./node_modules/webpack/bin/webpack.js --mode --watch-stdin --display minimal`) works as expected on Mac/osx/linux. So as long as it builds the app.js/app.css bundles we are generally good to go.
 
 Comment 3: Holding off on the PR.  It seems to already be fixed on the `master` branch (but not `v1.4`).  It was fixed here: #3430 
 Comment 4: Ah, good catch! @Gazler can you backport  #3430  to v1.4 when you get a chance? Thanks!
 Comment 5: Done. Also backported https://github.com/phoenixframework/phoenix/pull/3189
{'source': 'GithubIssues', 'repo_name_with_owner': 'phoenixframework/phoenix', 'issue_id': 491942455, 'repo_stars': 18744.0}