Bump Commoner version to disable dependency scanning by default

If you are using `bin/jsx` independently, you may need to pass `--follow-requires` to it if you rely on its dependency scanning.

Dependency scanning is still a good idea, but it's difficult to make it work perfectly for everyone the first time they try `bin/jsx`.

Closes #131.

cc @petehunt @zpao