Upgrade to lerna@2.11, rebuild package-lock

[shawnbot]

This is an attempt to get Travis (and local!) bootstraps of the monorepo working again by:

1. Upgrading to the latest 2.x release of Lerna (v2.11.0)
2. Renaming the root package.json dependencies field from devDependencies to dependencies
3. Rebuilding package-lock.json
4. Running npm audit fix to deal with some security issues

🤞

/cc @primer/ds-core

[shawnbot]

Okay, I've merged this into #556 and it appears to be working there. In the interest of making it easier to update other branches, I'd like to merge this to master. @jonrohan, you cool with that assuming it looks good otherwise?

[jonrohan]

I can’t remember if there was a specific reason for putting the dependencies outside of dev, but it seemed to work.