Upgrade nsp

[chenba]

This is a follow-up to #4280. The newer version of nsp is not ignoring the advisories we ask it to in .nsprc. A configuration change is probably needed.

[chenba]

Actually, let's wait on https://github.com/nodesecurity/nsp/issues/207 for this.

[chenba]

Now that npm has acquired NSP: "This service remains operational for current users in its current state. No new features or fixes will be implemented." The nsp repo has been archived and that above link to the issue returns a 404. 😞

[chenba]

Looks like npm/npm#20565 is relevant to our interest.

[pdehaan]

Actually, it looks like the Node Security Platform (nsp) service is shutting down 9/30.
They recommend switching to npm@6's $ npm audit as a replacement.

[jaredhirsch]

Still no update on a replacement for .nsprc in npm 6

[pdehaan]

I'm not a huge fan of npm audit yet, as it seems like a poor clone of the nsp service. Plus, forcing everybody onto npm@6 seems poor.

I know some other projects are using https://snyk.io/ to manage vuln detection.

[ghost]

closing in favor of #4704