Peg zombie's html5 to v0.3.8 to avoid breakage

We don't use html5 except through zombie.  HTML5 v0.3.10 currently
breaks zombie for us; but zombie permits that version via its
package.json. Explicitly install 0.3.8 to avoid this breakage.