Fixes #124 to put this repo inline with focus-trap-react:

- update all deps to latest versions
- move to yarn with yarn.lock
- use Webpack to build instead of Browserify (see below
  for more details)
- update Prettier and run on all the source (same rules as
  focus-trap-react)
- add check for types so that problems like #123 don't
  happen again
- (*) fixes bug in package.json 'main' that wasn't pointing to
  /dist/focus-trap.js (build output)

Because of (*) this should be published as a new __major__ release,
just to be safe, even though there shouldn't be any breaking
changes as a result (famous last words...).

This should also close-out a bunch of the security-related
notices on the repo from Dependabot because of old package
versions with vulnerabilities.

Added Webpack builds and removed some deps:

- Webpack Dev and Prod builds, mimicing old Browserify builds.
- Removed Browserify: Webpack replaces.
- Removed uglify: Webpack takes care of this now.
- Removed xtend: simple ES6 object merging works fine.

Fixed 2 small bugs:

- Fixed bug on line 316 of index.js where an NPE would happen
  if the trap was created without `userOptions`; should be
  `config.preventScroll` instead since we create `config` early
  on within the module and use that everywhere instead of
  `userOptions`.
- Fixed bug in allow-click-outside demo by disabling ESC: Otherwise,
  the 'activate trap' button state would get out of sync with
  the state of the trap (would remain 'deactivate trap' after
  pressing ESC).

NOTE: Publishing is still done manually from a local repo.
If we move this repo to Changesets later, we can start
doing releases via GitHub Actions like `focus-trap-react`.