Point out npm's usage of .gitignore on the npm-json(1) page

This calls out a potentially confusing behavior. See #1862.