Use the `files` directive in `package.json` instead of `.npmignore`

`.npmignore` is a blacklist, while `files` is a whitelist-based approach. The latter is much easier to maintain. See https://www.npmjs.org/doc/files/package.json.html#files for more info.

This patch does not affect the files that are included in the package.