Use Buffer.(from|alloc) instead of deprecated Buffer API

[ChALkeR]

This also includes a dependnecy on a polyfill targeting older Node.js versions where Buffer.alloc() and Buffer.from() API is not implemented (Node.js < 4.5.0 and some 5.x versions).

This is mostly a line-to-line change, though in some cases, minor code simplification was done, e.g.

var version = new Buffer(1);
version.writeUInt8(1, 0);

was transformed into

var version = Buffer.from([1]);

Ref: nodejs/node#19079
Ref: https://nodejs.org/api/deprecations.html#deprecations_dep0005_buffer_constructor
Ref: https://nodejs.org/api/buffer.html#buffer_class_buffer
Ref: https://github.com/ChALkeR/safer-buffer/blob/master/Porting-Buffer.md
Fixes: #45

Note that this does not completely solve the problem yet, for a complete solution, asn1 (a dependency) should also receive this fix (see below for that one).

But fixing the API usage in this package is still required, and a significant portion of tests pass without ever hitting the deprecated Buffer API in asn1 dependency.

[ChALkeR]

asn1 fix in TritonDataCenter/node-asn1#30.

[BYK]

@arekinath would be great if you can merge this and release a new version as this is blocking Yarn from being Node 10 compatible.

We can use the fork but that's less than ideal.

[ChALkeR]

/cc @cjihrig and @Trott perhaps?

[stevestock]

@arekinath

[shahkashani]

Bump <3 Would love to get this (and yarnpkg/yarn#5477) fixed!

[arekinath]

Merged as 175758a, released in 1.14.2

[ChALkeR]

@arekinath Thanks!

[BYK]

@arekinath thanks a lot for the merge and release! It would be ideal if we can propagate this fix all the way to upstream. There are a few more fixes on joyent repos:

• snyk security vuln. - update sshpk version node-http-signature#68
• Avoid using deprecated Buffer API on newer Node.js node-http-signature#67
• Use Buffer.(from|alloc) instead of deprecated Buffer API node-asn1#30

Do you think you can help with those too?

And since sshpk depends on asn1, we'd need to make another patch and release here once that PR is merged and released.