clean up API

This will be a new major version when published.

Part of the process of removing any implicit dependencies between `npm-registry-client` and npm's own configuration. Instead of using `{get,set}CredentialsByURI`, explicitly pass the credentials in when necessary.

There are two primary drivers for this work:

1. allowing registry URLs with paths (#70)
2. stop retconning auth out of fully-built registry URIs (supplants #77)

Both of these changes will require changes to npm/npm as well.

In the interests of making `npm-registry-client` a standalone API, I'm also doing the following:

- [x] explicitly passing in credentials to all methods that use them
- [x] making all calls to the registry use a consistent `f(URI, parameters object, callback function)` calling convention
- [x] explicitly configuring the client instead of passing in an npmconf "god object"
- [x] removing all direct side effects on the npm cache
- [x] simplifying the number of types accepted by API calls
- [x] improving the test coverage of non-happy-path cases

It makes sense to do this work now because the auth changes are already a breaking change to the API.

/cc @iarna for review