don't try to read missing dependencies

as happens when running tumor status before npm install
be more defensive about missing dependencies

the underlying problem is that the full dependency graph isn't expanded
up front, as was possible when we were getting the repository url from
the version instead of package.json

also better support https:// clone urls