Lock down all dependencies

- Lock down bower.json deps
- Lock down package.json deps
- Lock karma-coffee-preprocessor to keep it from throwing peer dep errors
- this makes staying up to date a more manual process but prevents
breakage of generated projects moving forward

fixes #138

/cc @eastridge