Use NPM packages instead of bower for formgrader extension dependencies

[brichet]

Fixes #1966
Should fix https://github.com/jupyter/nbgrader/security/dependabot/60

This PR replaces the use of deprecated bower by NPM.
It also updates underscore dependency to >=1.13.1, which should fix a security error.

[github-actions]

👈 Launch a Binder on branch brichet/nbgrader/remove_bower_dependency

[shreve]

Because we're using the exceptions below, we can replace all of these specific rules with a more general one:

nbgrader/server_extensions/formgrader/static/node_modules/**/*

I think this would make maintenance a tiny bit easier moving forward.

[brichet]

I think it would be quite similar, we would have to specify which files we want to keep instead of specifying which files we want to remove.
We probably want to keep package.json files, readme and some other files to know the version fetched.

The exceptions below are to prevent the following to remove these directories:

nbgrader/.gitignore

Line 13 in ab7ef18

dist/

[shreve]

Ah, I see what you mean. I think the change I want to see goes well beyond the scope of this PR. Thanks for clarifying.