Move bundled server dep into its own config

It's not really a normal dev dependency: it's a version number used
to download the prebuilt packaged server build. Also, electron-builder
won't let us read package-lock or devDeps in production code, and this
is the cleanest way to track the version of this independently.

Author: pimterry