update the browser versions of vm-browserify and string_decoder.

string_decoder updates to the Node 8+ API. vm-browserify replaces an unlicensed dependency by an MIT one.

https://github.com/browserify/browserify/pull/1829