package.json: Require npm 5.8

npm 5.8 is the last known version to support --no-optional,
which avoids many unessential items in package-lock.json

As travis installs the npm version in package.json, and
uses `npm ci` instead of `npm install` when 5.8 is found,
override `install` to avoid `npm ci` failing because
'optional' `validate-npm-package-name` is not found.

Related to npm/npm#17633

Closes #28

.travis.yml

@@ -26,6 +26,17 @@ before_script:
   - sh -e /etc/init.d/xvfb start
   - sleep 3 # give xvfb some time to start
 
+before_install:
+  - npm install --no-save --no-optional --only=dev [email protected]
+
+install:
+  - npm install --no-save --no-optional
+
+before_install:
+  # bufferstream in package-lock.json means optional dependencies
+  # have been included.
+  - if grep bufferstream package-lock.json ; then false; fi
+
 script:
   - script/build.sh
   - npm run test

package.json

@@ -48,6 +48,7 @@
     "json-loader": "^0.5.4",
     "less": "^2.7.1",
     "less-loader": "^4.0.5",
+    "npm": "^5.8.0",
     "npm-run-all": "^4.1.3",
     "selenium-standalone": "^6.15.1",
     "style-loader": "^0.18.2",
@@ -94,5 +95,8 @@
     "ultramarked": "^1.7.0",
     "underscore": "^1.8.3",
     "unfetch": "^3.0.0"
+  },
+  "engines": {
+    "npm": "~5.8.0"
   }
 }