Vulnerability: Prototype Pollution via the main (merge) function

### Description

Found by vulnerability check `OWASP:UsingComponentWithKnownVulnerability`

Filename: merge:2.1.1 | Reference: CVE-2021-23397 | CVSS Score: 9.8 | Category: CWE-1321 | All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead.

dependency tree:

```
commitizen@4.2.6
└ find-node-modules@2.1.3
└ merge@2.1.1
```

caused by https://github.com/callumacrae/find-node-modules/issues/18

awaiting fix to upgrade to `find-node-modules@2.1.4`

### Steps to reproduce

1. Clone this repo
2. Install dependencies `npm i`
3. observe vulnerability

### Environment

- commitizen@4.2.6

Wrongly raised in https://github.com/commitizen-tools/commitizen/issues/654