Extract Notifications into a dependency

[groenroos]

Not every Sapling instance will necessarily need to send emails (or in the future, texts or push notifications), so making every Sapling instance install nodemailer and front-matter for that seems unnecessary.

Refactor notifications to be their own separate dependency that can be optionally installed to Sapling.

[groenroos]

Open question remains on how should the built-in password reset hook function if the Notification dependency is not present - although given that it can similarly be currently nonfunctional if nodemailer hasn't been configured correctly, this may be a wider consideration.