Don't fail silently when no version specified in the JSON (#439)

This fix isn't quite what was originally intended.

The reason why it was failing silently before was because there was no error handling around the situation where no endpoint is passed to new Package(). I have added in an extra check for that situation which gives an error.

However, in the specific case that the version for a dep is given as `null` or `""` it seems reasonably clear to me that this means "latest". So I convert it to "*" and issue a warning.