Disallow private packages

This is only 3 lines of code changed in validate_doc_update, corresponding with the npm publish-privates pull request.

Packages are now rejected if they have "private":true set. Nobody can ever publish private packages to the central registry. OTOH, you can set the _security object, `{"npm":{ "publish-privates":true }}` (same as the npm config setting) and it will allow them.

The rest of the patch is the node-tap stuff. I figure it's about time we start unit testing the validator. It's the keys to the castle.