Force project to use v2.4 of HTML_CodeSniffer (#14)

A side-effect of NPM using the `package-log.json` file is that this file
is _not_ published with an NPM package, which means that, when NPM tries
to resolve dependencies on an npm install it will happily install newer
versions of dependencies as long as they fulfil whatever conditions
specified in the `package.json` file (not the lockfile).

For example,

* `[email protected]`:
  * requires `pa11y-runner-htmlcs@^1.2.0`
  * has `[email protected]` in its package-lock.json
* `[email protected]`:
  * requires `html_codesniffer@^2.4.1`
  * has `[email protected]` in its package-lock.json

Running:

```sh
npm install --global [email protected]
```

...will result in the installation of [email protected], which will pull
[email protected] (intended, although by accident) and
[email protected] (unintended). HTML_CS 2.5 contains new WCAG 2.1
rules that we've decided to keep for pa11y v6 as to try to ensure that
we don't break people's workflows.

This commit replaces `^` with `~` in the package.json, pinning htmlcs to
version 2.4.x

package.json

@@ -33,6 +33,6 @@
     "test": "make ci"
   },
   "dependencies": {
-    "html_codesniffer": "^2.4.1"
+    "html_codesniffer": "~2.4.1"
   }
 }