NPM protocol: publish, search, show, download

Implemented the first draft of NPM protocol.

Caveats:
- No authentication (everybody can upload).
- We don't verify that package.json matches URL parameters (i.e. you
  can upload 'foo-x.y.z.tgz' as a new version of 'bar-x.y.z.tgz').
- We ignore properties sent by npm client like SHA checksum and compute
  them ourselves instead.
- Tagging is not supported - everything is stored as 'latest'.