Sort out dependencies

[thomaseizinger]

We have some dependencies in dependencies that are actually devDependencies.

Even though the distinction is not important for Webpack (at least I think it is not), dependabot could be configured to merge devDependencies updates on its own.

Blocked by #153 to prevent regressions from removing packages.

Candidates:

• copy-webpack-plugin
• favicons-webpack-plugin
• ip