Upgrade sha.js for IE9 fix

I'm not sure why sha.js is locked at 2.1.8, but I need to upgrade to 2.2.5 to get crypto working in IE9. See https://github.com/dominictarr/sha.js/pull/11.

Some pbkdf2 test is failing, but it's already failing on master.

You may also want to consider changing the testling config to include more browsers than just latest.