allow local paths in package.json, but disallow publishing when this is the case

I've made PR for your PR. `npm-package-arg` made this much easier to do than the old code.

fixes #2442
fixes #4018

and probably a dozen others like them.
Thanks @NickHeiner, good suggestion.

I believe the spec for `concat` says the parameters can be arrays or values, so i left off the `[ ]`.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/concat