deps: remove commitizen as local dep

[brendankenny]

There's a security vulnerability in a transitive dep of commitizen which doesn't currently have a fixed version.

Buuuut, I don't think anyone here actually uses commitizen? And even if they do, all the docs I can find instruct that it should be installed globally, and we don't provide an npm script to access the version in node_modules, so not sure why we have it in here anyways.

If anyone does use it when writing commits, that use case isn't broken since cz-customizable and the package.json config entry are still around, so will work as is if you have commitizen installed globally.

(also, yarn changelog isn't affected by this as commitizen is only the writing side of things and conventional-changelog doesn't depend on it to read commit messages)

[brendankenny]

also, also, the knock-on dependency changes are kind of crazy

[paulirish]

works for me. i use it occasionally but w/e. not a big deal.

[patrickhulce]

WFM, I tend to end up editing the message on GH anyhoo

[brendankenny]

just to be clear, I'm pretty sure everything still works as before (with a global commitizen), unless someone happened to be doing npm explore commitizen -- ....

I don't want to make people who use commitizen feel unwelcome :)

[connorjclark]

+1 for removing :)

[brendankenny]

If anyone is worried about our deps getting too skinny, we still have another fill-range and two versions of is-number in here :)