Make underscore a dependency

Underscore is used directly by synapse-common, not as a plugin. It needs to be listed as a dependency.

### Acceptance Criteria
1. Make underscore a dependency, not a devDependency
1. Update underscore to 1.7.0