Security update for Mocha v3.5.3

[nickkolok]

Mocha v3.5.3 is recognized as insecure by npm audit.
I've turned out that updating debug dependence from 2.6.8 to 2.6.9 removes some vulnerabilities.
The appropriate patch is here: https://github.com/nickkolok/mocha/tree/v3.5.3-security-fixes

If growl 1.9.3 will be uploaded to NPM, then we can try to update it, too (see tj/node-growl#81). You cannot use 1.10.* instead.
All the other found vulnerabilities are in dev dependencies.

I know that there is no official LTS support, but I believe that simple publishing a fixed package as 3.5.4 is a good first step to it. Everything is ready, just test (one more time!) and publish.

[boneskull]

@nickkolok Why do you need to use Mocha v3.5.3?

While we may support LTS releases in the not-too-distant future, the v3 major is too old to be on our radar.