target a slightly newer sinon to avoid critical npm audit issue

[justinTNT]

old sinon uses unmaintained 'build' package which bumps into https://nodesecurity.io/advisories/16