Use github tarball link for esprima dependency

It turns out that (at least for local development) npm has a long
standing bug where it doesn't recognize changing dependencies stored as
git urls (see https://github.com/isaacs/npm/issues/1727). Luckily npm
understand tarballs and GitHub provides tarballs for every commit, so
the workaround is easy, though unfortunate.

We'll want to put out a 0.3.x for this so that we don't break it when @jeffmo updates esprima