update tap and minipass

This avoids the hazardous regression in [email protected], and makes npm
audit happier with a new version of tap.

Author: isaacs