deps: Change zxcvbn download method from download-zxcvbn to npm.

- Replace download-zxcvbn with downloading it from npm.
- Change zxcvbn.js path to node_modules (because npm put it to
`node_modules` directory.
- Bump `PROVISION_VERSION` in `version.py` to 2.4.

Fixes #2423.

static/js/settings.js

@@ -187,7 +187,7 @@ function _setup_page() {
         if (page_params.password_auth_enabled !== false) {
             // zxcvbn.js is pretty big, and is only needed on password
             // change, so load it asynchronously.
-            $.getScript('/static/third/zxcvbn/zxcvbn.js', function () {
+            $.getScript('/static/node_modules/zxcvbn/dist/zxcvbn.js', function () {
                 $('#pw_strength .bar').removeClass("fade");
             });
         }