Update npm-run-all due to malicious subdependency

[jjanssen]

In the past week somebody notifed a Bitcoin stealer within the flatmap-stream module. As this commonly found with the sub-dependency (of its sub-dependencies) this became a huge deal for the development infrastructure of a lot of people.

Within our current setup flatmap-stream is used by npm-run-all as part of our front-end tooling chain for building. This PR updates npm-run-all and makes sure flatmap-stream is removed from its sub-dependencies.

More reading about this:
dominictarr/event-stream#116
mysticatea/npm-run-all#154

https://www.theregister.co.uk/2018/11/26/npm_repo_bitcoin_stealer/
https://medium.com/@jsoverson/exploiting-developer-infrastructure-is-insanely-easy-9849937e81d4

[jjanssen]

Command for double-checking your local environment:
npm ls event-stream flatmap-stream

wagtail (master)*$ npm ls event-stream flatmap-stream
wagtail@1.0.0 /Users/j.janssen/Sites/git-projects/wagtail-jjanssen
└── (empty)

Which should now return empty.