security: mitigate CVE-2018-20834 (via #1434)

* fix: support path parameter inclusion when used twice in a path

* fix quote

* switch to Conde Nast fork of `bundlesize`

* Revert "switch to Conde Nast fork of `bundlesize`"

This reverts commit aaa6226.

No longer need to switch, because `bundlesize` maintainers
flighted the fix we need:
siddharthkp/bundlesize#298 (comment)

* bump minimum bundlesize version

* `mocha-webpack` -> `@kyleshockey/mocha-webpack`

* use @kyleshockey/[email protected]

uses a newer chokidar version that doesn't need `tar`

Author: shockey