package: Pin `mocha` and update `co-mocha`

`co-mocha` defines `mocha` as its peerDependency, so shouldn't use `*`
as our `mocha` version.  this should fix travis builds.