Don't allow version 0.0.24 of the `tmp` package.

Version 0.0.24 of the `tmp` package breaks us, because it changes the
number of arguments to a callback function.  This is because the
`promisify` API in `prfun` is unnecessarily fragile; see
https://github.com/bower/bower/pull/1403#issuecomment-48784169
for some discussion.

Change-Id: I2a2bada10798e7f73622329378280c5b81157043