Avoid ws CVE-2021-32640

[glasser]

Apollo Server 2 depends on subscriptions-transport-ws for a
superficial implementation of GraphQL subscription support. (Apollo
Server 3.0.0 will not have built-in subscription support.) This
unmaintained package depended on ws v5. All releases of v5 ws have a
server DOS vulnerability: https://www.npmjs.com/advisories/1748

This change:

• Removes the direct dependency on ws from apollo-server-core. This
  dependency was only used for types, so its imports have been changed
  to import type which pulls from @types/ws.
• Updates the subscriptions-transport-ws dependency in
  apollo-server-core and apollo-server-express to the newly-released
  0.9.19, which allows for ws v6 and v7. This means that via
  appropriate npm installations, you can install one of the
  non-vulnerable versions (6.2.2+ or 7.4.6+). Note that there are
  backwards incompatible changes in ws v6 and v7; see
  https://github.com/websockets/ws/releases/tag/6.0.0 and
  https://github.com/websockets/ws/releases/tag/7.0.0 for details.
• Does some other small upgrades of ws-related packages.

Note that the best way to protect yourself from this vulnerability is to
avoid using the unmaintained subscriptions-transport-ws entirely by
passing subscriptions: false to new ApolloServer and (if you do need
to use subscriptions) using a maintained GraphQL subscription server
such as graphql-ws.