Remove chai + mocha from dependencies

mocha and chai are now included as devDeepndencies rather than dependencies.

The versions being used were reported by Snyk as allowing a Prototype Pollution vulnerability. Although any consuming apps very unlikely to utilise chai or mocha in a way that would include it as production code (in fact this would probably be very hard to achieve), this new release has been issued so as to make clear the intent that given the knowledge of these vulnerabilities, these libraries should in no way be considered dependencies.