List all dependencies in each package.json
...instead of relying on pubsweet-client installing stuff for us.
Everything has gone into dependencies except react and pubsweet-{client,server} which is in peerDependencies.
Also previously some packages had yarn.lock and some didn't. Have committed the missing ones. And removed one rogue package-lock.json.