Update dependency helmet to v3

[mend-for-github-com]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
helmet (source)	^2.0.0 → ^3.0.0

By merging this PR, the issue #9 will be automatically resolved and closed:

Severity	CVSS Score	Vulnerability	Reachability
Medium	5.3	CVE-2017-16137	Unreachable
Medium	4.3	CVE-2017-20162	Unreachable
Low	3.5	CVE-2017-20165	Reachable

---

Release Notes

helmetjs/helmet (helmet)

v3.8.2

Compare Source

Changed

• Updated connect dependency to latest

v3.8.1

Compare Source

Fixed

• csp does not automatically set report-to when setting report-uri

v3.8.0

Compare Source

Changed

• hsts no longer cares whether it's HTTPS and always sets the header

v3.7.0

Compare Source

Added

• csp now supports report-to directive

Changed

• Throw an error when used incorrectly
• Add a few documentation files to npmignore

v3.6.1

Compare Source

Changed

• Bump connect version

v3.6.0

Compare Source

Added

• expectCt middleware for setting the Expect-CT header

v3.5.0

Compare Source

Added

• csp now supports the worker-src directive

v3.4.1

Compare Source

Changed

• Bump connect version

v3.4.0

Compare Source

Added

• csp now supports more sandbox directives

v3.3.0

Compare Source

Added

• referrerPolicy allows strict-origin and strict-origin-when-cross-origin directives

Changed

• Bump connect version

v3.2.0

Compare Source

Added

• csp now allows manifest-src directive

v3.1.0

Compare Source

Added

• csp now allows frame-src directive

v3.0.0

Compare Source

Changed

• csp will check your directives for common mistakes and throw errors if it finds them. This can be disabled with loose: true.
• Empty arrays are no longer allowed in csp. For source lists (like script-src or object-src), use the standard scriptSrc: ["'none'"]. The sandbox directive can be sandbox: true to block everything.
• false can disable a CSP directive. For example, scriptSrc: false is the same as not specifying it.
• In CSP, reportOnly: true no longer requires a report-uri to be set.
• hsts's maxAge now defaults to 180 days (instead of 1 day)
• hsts's maxAge parameter is seconds, not milliseconds
• hsts includes subdomains by default
• domain parameter in frameguard cannot be empty

Removed

• noEtag option no longer present in noCache
• iOS Chrome connect-src workaround in CSP module

---

• If you want to rebase/retry this PR, check this box