Fixed: npm was re-fetching tarballs on every `npm install`

Use the _resolved property from installed packages to avoid installing URL dependencies after they are already installed.  Also ensure that you can still use --force if the packages have really changed

This also fixes https://github.com/isaacs/npm/issues/3463 as shrinkwrapped dependencies are basically treated the same as tarball dependencies

Example package.json (any tarball URL will do, I just used one from the registry directly as it's small and I know everyone can get to it)

``` json
{
  "dependencies": {
    "once": "https://registry.npmjs.org/once/-/once-1.2.0.tgz"
  }
}
```

Existing behaviour:

```
$ time npm install
npm WARN package.json npm-cache-issue@0.0.0 No description
npm WARN package.json npm-cache-issue@0.0.0 No repository field.
npm WARN package.json npm-cache-issue@0.0.0 No README data
npm http GET https://registry.npmjs.org/once/-/once-1.2.0.tgz
npm http 200 https://registry.npmjs.org/once/-/once-1.2.0.tgz

real	0m2.398s
user	0m1.252s
sys	0m0.164s
```

With this patch:

```
$ npm install
npm WARN package.json npm-cache-issue@0.0.0 No description
npm WARN package.json npm-cache-issue@0.0.0 No repository field.
npm WARN package.json npm-cache-issue@0.0.0 No README data

real	0m1.306s
user	0m1.056s
sys	0m0.136s
```