WIP: Initial implementation

Algorithm is now:

 - run shrinkwrap, shrinkwrapping your current node_modules tree
 - run setResolved. This sets `resolved` values on shrinkwrap that are not set by `npm shrinkwrap` due to an inconsistency between `npm install` and `npm cache clear; npm install`.
 - run trimFrom. This trims the `from` field which is known to change a lot and cause git diff noise. The `from` field adds little / no value and we only delete it if its statically safe to do so.
 - run verify git. Because we do not do `rm -rf node_modules; npm install` we introduce a new type of bug. The bug is a user edits `package.json` but forgets to run `npm install` thus `package.json` & `npm-shrinkwrap` are out of data. Luckily npm handles this quite well with the `npm ls` output bitching about removed deps, added deps & changed versions. HOWEVER npm cannot statically verify whether your git dependencies are correctly installed. verify git adds static verification for this based on version tags.

### Todo

 - [ ] write cli
 - [ ] document cli
 - [ ] test cli in our applications

cc @sh1mmer @squamos @jcorbin