Explicitly list `punycode` as a dependency

That way nothing breaks if Node ever removes [punycode.js](http://mths.be/punycode) from its core.