CB-14145 pin even more added bundled deps in 5.0.x only

[brodycj]

Platforms affected

browser

What does this PR do?

• pin even more added bundled deps in 5.0.x only - needed to clear the red highlights in npm outdated --depth=0

What testing has been done on this change?

• npm audit shows 0 vulnerabilities (using npm@6.2.0)
• npm outdated --depth=0 shows no red entries
• coho audit-license-headers -r browser shows no missing license headers
• coho check-license -r browser shows no incorrect licenses (NOTE: this patch release now includes xmldom package which does not have correct SPDX expression; however, visual inspection of node_modules/xmldom/LICENSE shows MIT license option, which is acceptable.)
• npm test succeeds on AppVeyor CI & Travis CI
• able to add to new Cordova project using cordova platform add github:brodybits/cordova-browser#cb-14145-pin-even-more-added-bundled-deps-in-5.0.x-only then run using npm@2.15.11 (bundled with deprecated node v4.9.1 version)

Checklist

• Reported an issue in the JIRA database
• Commit message follows the format: "CB-3232: (android) Fix bug with resolving file paths", where CB-xxxx is the JIRA ID & "android" is the platform affected.
• Added automated test coverage as appropriate for this change.