Re-add Winston for logging

We removed it in 7f62be9af497c51e72310327e27ae93043594135 when we
thought it might be causing production issues, but those were not
due to Winston.

- Development: log debug messages in colour to the console
- Everything else: log JSON messages to a file in /var/log/spotlight

We are still using the Express dev logger in every environment. This
is just a first pass.

Log rotation is not handled by the app.
Lint app/server.js
Merge pull request #56 from alphagov/reinstate-logging-winston-61740880

Reinstate logging with Winston