Lock starter dependency to a sha or tag
Right now, pubsweet new
pulls the latest master of pubsweet-starter
. This has caused a few bugs in the past, and it would make sense if we lock the version of starter to a sha or a tag, or perhaps switch to using npm for starter (make it a package).