Fix: Exclude devDependencies from attribution.txt

The generated file `attribution.txt` was intended to exclude all
`devDependencies`, but a few snuck their way in anyway. The
`build:attribution` script we use to generate that file has been
updated to ensure that `devDependencies` are excluded.

The old script was deleting `devDependencies` from `package.json` in
an attempt to exclude them, but this wasn't working properly because
the package we use to find all licences was looking on-disk for them,
not walking through the dependency graph starting at our manifest.

The script now explicitly deletes `node_modules` and re-installs with
only production dependencies, so they are the only ones present on-disk
for the license checker to find.

The script now leaves the project in a state where only production
dependencies are installed, so a reminder to run `yarn setup` was added
to the end of the script

Fixes MetaMask/MetaMask-planning#2182