allow local paths in package.json, but disallow publishing when this is the case

I've made PR for your PR. `npm-package-arg` made this much easier to do than the old code.

fixes #2442
fixes #4018

and probably a dozen others like them.
:+1: for having the error message actually tell the user what the offending entry is.