pin npm-run-all@4.1.5

[shawnbot]

This removes our indirect dependency on event-stream and flatmap-stream, the latter of which was recently compromised and removed from npm, breaking our CI builds. Here's where it came from:

primer/primer
└─┬ npm-run-all@4.1.3
  └─┬ ps-tree@1.1.0
    └─┬ event-stream@3.3.6
      └── flatmap-stream@0.1.2 

Note: npm-run-all is a dependency of the top-level monorepo package.json, and is not included in any of our published packages.