move istanbul to dev dependencies

Due to pulling in istanbul as a standard dependency it could happen to break builds or even install unwanted packages in production environments.