Bump semver to version 3

This makes the '^' operator stricter for 0.x.y versions, even if 'x' is
not 0.

As a direct result, several *other* deps had to be updated, because they
either depended on semver 2.x, or because the new stricter rules meant
that they (or their deps) were no longer valid.

The update to 'read-installed', in particular, causes a test failure.
That update must be rolled back, or the test made to pass, prior to a
stable npm 2.0.0 release going out.