update tap and minipass

This avoids the hazardous regression in minipass@2.8.4, and makes npm
audit happier with a new version of tap.

Author: isaacs