feat: sinon is a dev dependency

[FauxFaux]

Description

sinon, a mocking framework used in tests, is listed as a production dependency. sinon is bigger than all of the rest of the code and tests and dependencies combined, so it's a shame shipping it as a production dependency.

Change it to a dev dependency, only available for tests.

Testing

faux@astoria:~/clone/node-xml-encryption% g grep sinon | fgrep -v package-lock
package.json:    "sinon": "^9.0.2"
test/xmlenc.encryptedkey.js:var sinon = require('sinon');
test/xmlenc.encryptedkey.js:    consoleSpy = sinon.spy(console, 'warn');

[gkwang]

Thanks! It was added to prod dependency by mistake.

[gkwang]

@FauxFaux Can you kindly sign the commit since it's required for us to merge the change.

[FauxFaux]

Third time lucky!