publishConfig: conf.save() should save actual config, not pubConf

This avoids an error when the npm-registry-client gets a new token, and
attempts to call conf.save('user').  However, a publishConfig can't save
in this way, because it doesn't have a 'user' file source.

Binding the save to the parent config *does* avoid the error, but of course,
at the cost of making the save in this situation a no-op.