Don't allow version 0.0.24 of the `tmp` package.

Version 0.0.24 of the `tmp` package breaks us, because it changes the
number of arguments to a callback function.  This is because the
`promisify` API in `prfun` is unnecessarily fragile; see
https://github.com/bower/bower/pull/1403#issuecomment-48784169
for some discussion.

Change-Id: Ifd9e5b4627bedb5a8438f001cdddd46a0c62bde7