Fix: Keep sinon at ~1.10.3 (fixes #1406)

Note that this only further specifies the `sinon` version; it does not do any shrinkwrapping on the assumption that doing so would be a separate discussion, especially because `sinon` is a dev dependency, which means it wouldn't normally be shrinkwrapped.