deps: upgrade npm to 2.7.5

[othiym23]

This release of npm is a little more important than most, because it contains two security fixes:

• 300834e
[email protected]: Normalize symbolic links that point to targets outside the
  extraction root. This prevents packages containing symbolic links from
  overwriting targets outside the expected paths for a package. Thanks to Tim
  Cuthbertson and the team at Lift
  Security for working with the npm team to identify
  this issue. (@othiym23)
• 0dc6875
[email protected]: Package versions can be no more than 256 characters long.
  This prevents a situation in which parsing the version number can use
  exponentially more time and memory to parse, leading to a potential denial of
  service. Thanks to Adam Baldwin at Lift Security for bringing this to our
  attention. (@isaacs)

The severity is medium and the impact is low, at least for now. We have no evidence that either of these vulnerabilities were being exploited in the wild. All the same, it would be good to get people upgrading.

This version also contains two important fixes to npm's git / GitHub support:

• eab6184
  #7766 One last tweak to ensure that
  GitHub shortcuts work with private repositories.
  (@iarna)
• a840a13
  #7746 Only fix up git URL paths when
  there are paths to fix up. (@othiym23)

Unfortunately, [email protected] is missing the final piece of the git puzzle:

• b747593
  #7630 Don't automatically log all
  git failures as errors. maybeGithub needs to be able to fail without
  logging to support its fallback logic.
  (@othiym23)

In most cases, [email protected] will work fine with private GitHub repositories, but it will log an ugly and misleading message about what it's doing. The above change (which is part of [email protected]) takes care of that, but I still don't think it's a good idea to jump the gun with npm releases. I could maybe be persuaded otherwise.

[othiym23]

Closing in favor of #15617.