attachment: include tmp plugin in package.json

optional section. This goes with Steve's July 2 changes to the attachment plugin. It prevents error messages like this:

[WARN] [-] [attachment] This module requires the 'tmp' module to extract filenames from archive files