fix: update lerna and resolve audit issues

[escapedcat]

Resolving following audit issues:

• handlebars: by updating lerna to latest version
• tar: by adding a resolution to package.json because outdated versions are used by too many deps
  • Tar package vulnerability on install npm/npm-lifecycle#28
  • docsify-cli > livereload > chokidar > fsevents > node-pre-gyp > tar
docsify-cli seems outdated, not sure about livereload, the rest was updated pretty recently.
    is there an easy way to see which dep is the problematic one?
• js-yaml: by adding a resolution to package.json till cosmiconfig released a fix version (again, yes. not their fault). Watching this now: Code injection security vulnerability at js-yaml cosmiconfig/cosmiconfig#183

[escapedcat]

@marionebl not sure why these dep updates make the node 10 circle build fail.
Would be great if you could have a look.
yarn install --ignore-engines which seems to be the failing command works on my machine which is using node 10.1.0.

[marionebl]

Superseeded by master changes