Update heroku-client to patch security issue

[oskeke]

heroku-client@2.4.3 uses the tunnel-agent dependency with a known security issue, https://nodesecurity.io/advisories/598.

Please update to the 3.0.6 version that contains the patch.

[kjarmicki]

Unfortunately, this is not that easy. There was a massive change of heroku-client interface between 2.x and 3.x and all the convenience methods that we use (like app.addons().create()) are gone. Substantial rewrite would be required to accomodate for the new interface.

That being said, bumping tunnel-agent specifically is still possible - either hacky, by specifying tunnel-agent@0.6.0 directly as a HeroIn dependency and letting npm do the deduplication, or by forking heroku-client@2.4.3, specifying appropriate version there and pointing HeroIn to a fork.

Since I'm phasing out as a maintainer of this project, please feel free to choose the approach and issue a PR :)