allow local paths in package.json, but disallow publishing when this is the case

I've made PR for your PR. `npm-package-arg` made this much easier to do than the old code.

fixes #2442
fixes #4018

and probably a dozen others like them.
It's odd to do an imperative mutation with `reduce`. Either use `forEach` and a destructive update (`push`), or `reduce` and a non-destructive update (`concat`).

```js
var acc = [];
items.forEach(function (el) {
    acc.push(el);
});
```

```js
items.reduce(function (acc, el) {
    return acc.concat([el]);
}, []);
```