lock (client-side) Highlight.js to a non-broken version

because https://github.com/isagalaev/highlight.js/issues/662

Incidentally, if and when we ship https://github.com/npm/newww/pull/312, this will become a non-issue because the client-side code will be gone.