Reintroduce fixed Mongoose dependency

[tomgreenfield]

The PR reintroduces the mongoose@5.8.13 dependency, which in turn pulls down the last version of mongodb that's known to work with the domain/session code in the authoring tool. Reference: #2504.

This does surface the following warnings in recent versions of Node.js:

(node:20860) Warning: Accessing non-existent property 'count' of module exports inside circular dependency
(node:20860) Warning: Accessing non-existent property 'findOne' of module exports inside circular dependency
(node:20860) Warning: Accessing non-existent property 'remove' of module exports inside circular dependency
(node:20860) Warning: Accessing non-existent property 'updateOne' of module exports inside circular dependency

However, this seems like an adequate compromise having already done a sizeable chuck of debugging to try and ascertain why the domain goes missing in the middleware with later versions of mongodb.

This prevents the 'sticky session' problem detailed in #2540.

Tested in Node 12 & 14.

[taylortom]

worksforme 🎉