Make npm audit fail the tests

[ianb]

In #4617 (specifically a5935e1) we added npm audit and removed nsp (per #4704). But npm audit is run like npm audit || true, as we have failures we can't reasonably fix. We should reenable it as something that can make the CI tests fail.

I personally would propose we use npm audit --json | ./bin/some_ignoring_script where write some_ignoring_script to parse the JSON and ignore some packages we don't care to fix. E.g., jpm has a dependency (open) with a "critical error" that I feel confident we can ignore (because it is only used in our build system, never with untrusted input).

[g-k]

We have a handful of projects with this problem in https://bugzilla.mozilla.org/show_bug.cgi?id=147611, so I took a stab at this here: https://github.com/mozilla-services/audit-filter

Let me know if that works for screenshots.