Check save-prefix satisfies requested install version range

[gosplit]

The bug report is also opened in npm community.

In short, the recent Angular Compiler requires older typescript packages and asks users to run npm install typescript@">=3.1.1 <3.3"

However, after running the install command, package.json will be update to typescript@^3.2.4, which will still pull incompatible version, eg.'typescript@3.3.0' in other build machine. So I add some checks in computeVersionSpec to ensure adding the save-prefix ^ or ~ only when it satisfies requested version range.

[isaacs]

I think there's probably a better way to do this, but I get that this is a problem. If the user provides a complex range, and save-prefix + resolved version is not a subset of that range, then it's a problem. In that case, I'd prefer to save the range that the user provided, but of course that can run into issues if you do something like npm i foo@'>=1.0.0 or something, because you'll pick up a semver major without realizing it. Maybe that's fine, if that's what they want? This needs some more discussion, though.

[gosplit]

I agree with @isaacs. It's better if we can just save the user-provided range in the package.json file.
However, as labeled, this new implementation will break back-compatibility.
To compromise with the back-compatibility, maybe we can just try out [^,~,''] to find the first suitable save-prefix to save?

[isaacs]

npm/arborist#127