Update dependencies so "critical" vulnerabilities are no longer logged on the command line when running npm install

**Sails version**: 1.1
**Node version**: 8.12
**NPM version**: 6.9.0
**DB adapter name**: N/A
**DB adapter version**: N/A
**Operating system**: Linux

When one creates a new sails application, using:

`sails new test-application`

Many outdated libraries are installed, many of those libraries have some or several bugs and (more dangerously), vulnerabilities. Even worse, sails indicates those libraries are used by production, not making any difference between normal dependencies and dev dependencies in package.json.

This makes CI nearly impossible.

`found 273 vulnerabilities (58 low, 211 moderate, 2 high, 2 critical) in 3874 scanned packages`

Audit can fix the ones depending on a minor version of grunt (168 of them). However that still leaves a lot. I looked through the log and could summarise it as follow:

*sails-hook-grunt*
https://npmjs.com/advisories/785 (low) clean-css, patched in >= 4.1.11
https://npmjs.com/advisories/745 (moderate) underscore.string patched in >= 3.3.5
https://npmjs.com/advisories/543 (low) debug, patched in >= 3.1.0
https://npmjs.com/advisories/577 (low) lodash, patched in >=4.17.5
https://npmjs.com/advisories/782 (moderate) lodash, patched in >=4.17.11

*sails-hook-sockets*
https://npmjs.com/advisories/577 (low) lodash, patched in >=4.17.5
https://npmjs.com/advisories/782 (moderate) lodash, patched in >=4.17.11

*sails*
https://npmjs.com/advisories/612 (low) deep-extend, patched in >= 0.5.1
https://npmjs.com/advisories/663 (critical) open, no patch but alternative library opn
https://npmjs.com/advisories/577 (low) lodash, patched in >=4.17.5
https://npmjs.com/advisories/782 (moderate) lodash, patched in >=4.17.11

*sails-hook-orm*
https://npmjs.com/advisories/577 (low) lodash, patched in >=4.17.5
https://npmjs.com/advisories/782 (moderate) lodash, patched in >=4.17.11

I left out all intermediate libraries for brevity (some might be fixed by updating intermediate libraries). But as one can see most of the errors can simply be fixed by updating lodash.
What is left over can be fixed by moving dependencies

This can be solved in two ways:

Either bump all versions on the libraries. Or (and?) move the non-production libraries to the correct area in package.json.