Specify three-to-cannon 1.3.0 exactly

Future versions have a bug which is awkward to work around; for
now, make sure we don't accidentally upgrade.

See donmccurdy/three-to-cannon#13.

package.json

@@ -54,6 +54,7 @@
     "react-intl": "^2.4.0",
     "screenfull": "^3.3.2",
     "super-hands": "github:mozillareality/aframe-super-hands-component#f8f9781d8b4c487bb544b3986000e85ed5f82fcc",
+    "three-to-cannon": "1.3.0",
     "uuid": "^3.2.1",
     "webrtc-adapter": "^6.0.2"
   },