audit: Ensure we don't mutate the shrinkwrap

PR-URL: #20389
Credit: @iarna
Reviewed-By: @zkat

lib/install/audit.js

@@ -22,6 +22,7 @@ const url = require('url')
 const npa = require('npm-package-arg')
 const uuid = require('uuid')
 const ssri = require('ssri')
+const cloneDeep = require('lodash.clonedeep')
 
 // used when scrubbing module names/specifiers
 const runId = uuid.v4()
@@ -100,7 +101,7 @@ function printFullReport (auditResult) {
 }
 
 function generate (shrinkwrap, requires, diffs, install, remove) {
-  const sw = Object.assign({}, shrinkwrap)
+  const sw = cloneDeep(shrinkwrap)
   delete sw.lockfileVersion
   sw.requires = scrubRequires(requires)
   scrubDeps(sw.dependencies)