Reduce security attack surface

[colonelpopcorn]

I would like to have fewer security fix PRs opened by dependabot. Reducing actual dependencies would go a long way to helping out with that. We just ship log4js so we should be able to define an interface that we can wrap log4js in and then people can use whatever logging library they want.

• Remove need for log4js by injecting logging library and just making it an interface
• Exclude development dependencies from regular dependabot scan
• Bump major version so that breaking changes don't actually break anybody