NX-620: Support for offsite tarballs

Off-site tarball support.

Notable changes/additions:
* NPM transport for tarballs
* NPM targeted content validation
* cache expiration fixed
* MD expiration fixed (per-document, not root which was already fixed)

Issue
https://issues.sonatype.org/browse/NX-620

CI
http://bamboo.s/browse/NX-NPMF10
Added `@Nullable` to make it cleat that return value might be `null`