Do not modify dependencies until coa vulnerability is resolved

[Nantris]

One or more of the dependencies for svgo depends on coa. The current version being installed with svgo is [email protected], which is safe.

Newer versions are infected with malware, so no dependencies should be added or upgraded until it's certain that the associated coa version is safe.

https://www.bleepingcomputer.com/news/security/popular-coa-npm-library-hijacked-to-steal-user-passwords/

---

Users should consider pinning their coa version via package.json's resolutions like so:

"resolutions": { 
  "coa": "2.0.2"
 }

[TrySound]

SVGO v2 does not use coa. SVGO v1 is no longer supported.

[TrySound]

I'll leave the issue open for others