Add semver dependency to the ovsx package

[msujew]

When trying to publish a package to open-vsx after installing ovsx via the command npm i -g @vscode/vsce ovsx, the package cannot seem to find the semver dependency. It's a transitive dependency from @vscode/vsce but explicitly used in the ovsx code.

This led to a failure in our deployment pipeline, see here.

This PR adds the semver package explicitly, so that this issue doesn't occur anymore.

[spoenemann]

Thanks!