NX-620: Support for offsite tarballs

Off-site tarball support.

Notable changes/additions:
* NPM transport for tarballs
* NPM targeted content validation
* cache expiration fixed
* MD expiration fixed (per-document, not root which was already fixed)

Issue
https://issues.sonatype.org/browse/NX-620

CI
http://bamboo.s/browse/NX-NPMF10
Yes, see [PackageVersion#validate()](https://github.com/sonatype/nexus-npm-repository-plugin/blob/sonatype-master/nexus-npm-repository-plugin/src/main/java/com/bolyuba/nexus/plugin/npm/metadata/PackageVersion.java#L60), no PackageVersion can be constructed from a map where `dist` key is not present and its value not a map.