Worth locking `normalize-scss` to a minor version?

```
  "normalize-scss": "2.1",
```

And getting `pasteup` tagged, so we can do the same - https://github.com/guardian/pasteup/tags