Lock tmp to 0.0.23 to fix a bug with bower's transient dependenc

The tmp package introduced a breaking change in a patch version.
This caused new bower installs to break with the following error
`TypeError: Arguments to path.join must be strings`.

Bower bugs for reference:
https://github.com/bower/bower/issues/1399
https://github.com/bower/bower/pull/1407

Unfortunately bumping bower to 1.3.8 doesn't resolve this issue
because grunt-bower-task depends on bower@1.2.x