Pin mccabe to prevent it from breaking hacking

mccabe has undergone some very significant bug fixes recently but has
not yet released a new version. When it does, complexity calculations
will change in potentially significant ways.

Cherry-picked onto 0.9.x to make sure a release of mccabe doesn't break
existing 0.9.x users.

Change-Id: I6e75391da19fde45588575517087d1ba4e4c44b7
(cherry picked from commit 7a649681f984f2a246eae23cd05d6973d14d5745)