Avoid too many files open with graceful-fs@3.0.3

While its purpose is (in our case) to avoid `EMFILE` errors, it looks like we're getting them with `graceful-fs@3.0.3` (but not `3.0.2`).  This change pegs not only `graceful-fs`, but also all of our other primary dependencies.  We still have no control over the versions of the transitive dependencies pulled in (we'd need [`npm-shrinkwrap` for that](https://www.npmjs.org/doc/cli/npm-shrinkwrap.html), but this reduces the chance of pulling in newly released bugs by a little bit.

Fixes #2828.