rfc138 npm audit metadata appended to headers

[doddi]

Following on from discussion against rfc-0027 this PR allows metadata from package.json to be appended to the header of the npm audit requests

Some third party application require more details for auditing, such is Nexus Lifecycle. This application applies policy against an application, an application may have different policies.
This change allows a metadata object contained in the projects package.json file to be transmitted as a header definition.

Example

{
  "name": "npm_project",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "dependencies": {
    "qs": "^2.4.2"
  },
  "metadata": {
    "npm-app-id": "helloapp"
  }
}

This example will add a metadata key to the http request header with a JSON.stringify representation of the metadata object.