allow local paths in package.json, but disallow publishing when this is the case

I've made PR for your PR. `npm-package-arg` made this much easier to do than the old code.

fixes #2442
fixes #4018

and probably a dozen others like them.