Improving ssb-npm bootstrapping

Improving #ssb-npm usability was discussed in the April SSBC call %TJC9UQl... &6+93YsF....

I have made a proof-of-concept of running ssb-npm-registry separate from scuttlebot: ssb-npm-bootstrap. This allows for installing ssb-npm packages without needing scuttlebot to be running, including, possibly, scuttlebot. It works by fetching and validating messages and blobs from a http server (e.g. a ssb-ws or ssb-viewer instance), and using that functionality to construct an sbot object to give to ssb-npm-registry. Requests to the ssb-npm-registry server run in this way must use message scope (i.e. the URL contains an id of a npm-packages message for the top-level package), so that ssb-npm-registry can serve the request deterministically, not needing sbot API methods other than blobs and message fetching.

This approach is not yet packaged nicely as a complete and easy solution, but I want to share this as a work in progress for those who might be interested. Later I might bundle it into ssb-npm-registry to replace the existing scuttlebot bootstrap mechanism which I think is a little unwieldy and limited, and try to figure out how to make it work for easy onboarding from pubs or peers. Other people can try this also. Feedback is welcome.

cc @ev @noffle @cryptix

@kode54 I don't yet have it working for installing patchfoo.