pin crypto-browserify to 3.3.0

A recent commit in https://github.com/indutny/brorand/blame/5f14e3492bcd089d21b0e7ced9ba5236a4fd6328/index.js#L52 messes up webpack builds; pinning crypto-browserify fixes the problem for now until either a) all module parsing is wrapped in an IIFE, or b) the illegal return statement is removed in https://github.com/indutny/brorand/.

See: https://github.com/webpack/webpack/issues/67.