Update heroku-client to patch security issue

[oskeke]

[email protected] uses the tunnel-agent dependency with a known security issue, https://nodesecurity.io/advisories/598.

Please update to the 3.0.6 version that contains the patch.

[kjarmicki]

Unfortunately, this is not that easy. There was a massive change of heroku-client interface between 2.x and 3.x and all the convenience methods that we use (like app.addons().create()) are gone. Substantial rewrite would be required to accomodate for the new interface.

That being said, bumping tunnel-agent specifically is still possible - either hacky, by specifying [email protected] directly as a HeroIn dependency and letting npm do the deduplication, or by forking [email protected], specifying appropriate version there and pointing HeroIn to a fork.

Since I'm phasing out as a maintainer of this project, please feel free to choose the approach and issue a PR :)