Pin two module versions to avoid flatmap-stream hack (#5839)

The flatmap-stream module was compromised. MetaMask was NOT affected,
but two of our dependencies could include it if they updated, so I am
temporarily pinning those versions until they can be updated
consciously.

Related to
https://github.com/dominictarr/event-stream/issues/116

package.json

@@ -276,7 +276,7 @@
     "gulp": "github:gulpjs/gulp#6d71a658c61edb3090221579d8f97dbe086ba2ed",
     "gulp-babel": "^7.0.0",
     "gulp-json-editor": "^2.2.1",
-    "gulp-livereload": "^4.0.0",
+    "gulp-livereload": "4.0.0",
     "gulp-multi-process": "^1.3.1",
     "gulp-replace": "^0.6.1",
     "gulp-sourcemaps": "^2.6.0",
@@ -326,7 +326,7 @@
     "rimraf": "^2.6.2",
     "sass-loader": "^7.0.1",
     "selenium-webdriver": "^3.5.0",
-    "shell-parallel": "^1.0.3",
+    "shell-parallel": "1.0.3",
     "sinon": "^5.0.0",
     "source-map": "^0.7.2",
     "static-server": "^2.2.1",