meteor3: nodemailer 4 -> 6.10

Drop-in for our usage: email.js only does createTransport(MAIL_URL) and reads
transport.options.auth.user (production-only from() branch) — both verified
identical in v6 (createTransport from a URL still populates options.auth.user).
Actual sending goes through ostrio:mailer (MailTime 2.5), v6-compatible. Mail
server inits clean ('I'm the mail server'); REST smoke byte-identical (12/12).

package-lock.json

@@ -51,7 +51,7 @@
         "moment-timezone": "^0.5.14",
         "node-geocoder": "^3.21.1",
         "node-gyp": "^3.7.0",
-        "nodemailer": "^4.4.2",
+        "nodemailer": "^6.10.1",
         "npm": "^5.8.0",
         "pm2-master": "^1.1.3",
         "popper.js": "^1.12.7",
@@ -13406,9 +13406,10 @@
       }
     },
     "node_modules/nodemailer": {
-      "version": "4.4.2",
-      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-4.4.2.tgz",
-      "integrity": "sha512-sstDxbCSPHDXrWRQhH++khr3yVU0CGvH2dCtAHOPQQ0lRR7xwq2txItEXckMpX481B/cN+0akER2bfExh7Gu/Q==",
+      "version": "6.10.1",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-6.10.1.tgz",
+      "integrity": "sha512-Z+iLaBGVaSjbIzQ4pX6XV41HrooLsQ10ZWPUehGmuantvzWoDVBnmsdUcOIDM1t+yPor5pDhVlDESgOMEGxhHA==",
+      "license": "MIT-0",
       "engines": {
         "node": ">=6.0.0"
       }