🏗 Enable package updates for E2E and visual diff tests

[rsimha]

There's a security vulnerability in one of our test deps that uses an outdated dependency version. It turns out this is because Renovate is configured to upgrade devDependencies, but leave dependencies alone (#23008).

This PR moves all of the E2E and visual diff packages to devDependencies to enable automatic upgrades. It also adds some logging to the E2E tests (I found this useful while testing these changes.)

Soon, we should see version upgrade PRs for the packages used by our tests.

[danielrozenberg]

Unfortunately we can't upgrade the deps for visual diff that easily, we need to make a significant code change. We could upgrade the lodash dep specifically to resolve this vulnerability (the vulnerability is not that relevant to us, since it allows for code injection in specific instances that we don't encounter - so there' no rush atm)

[rsimha]

Unfortunately we can't upgrade the deps for visual diff that easily, we need to make a significant code change.

I think the Renovate workflow can still be useful for dependency upgrades that don't break our tests, since they will be fully verified on Travis, and are merged manually.

Also, when a new dependency version causes a breaking change (say, with visual tests), there is precedent for closing out the PR and skipping that version.

We could upgrade the lodash dep specifically to resolve this vulnerability

It's an indirect dependency, so it's not trivial to manually upgrade it.

the vulnerability is not that relevant to us, since it allows for code injection in specific instances that we don't encounter - so there' no rush atm

Security vulnerabilities show up on the front page of the amphtml repo (if you have access to view them). I think it's worth addressing them as they appear.

[rsimha]

Adding a couple others for a review, since this is blocking the removal of security vulnerability warnings on the amphtml front page.

[rsimha]

Chatted offline with @danielrozenberg about his concerns about upgrading the visual diff dependencies. This PR will not force-upgrade them. We can close the renovate PRs for @percy/puppeteer and puppeteer until our code is ready for them.

[rsimha]

Update: Security alert has been addressed by #23457 which was generated as a result of this PR.