Update from winston 2.x to 3.x

The logging library we use, Winston, is out in 3.x since some time.

Now the dust from DWJW SF 2018 is settling down, we probably want to bump this.

Reading https://github.com/winstonjs/winston/blob/master/UPGRADE-3.0.md I anticipate this should be fairly straightforward since we didn't add any custom transport or the likes yet.