Guard against publishing files that depend on local files

[kwangure]

I usually use npm pack to test files locally . That has resulted in the tarball install path ending up in a published package before. It would be nice if Publint had a check guarding against packages installed from local files:

"dependencies": {
	"package": "file:../package-0.1.0.tgz"
}

[bluwy]

I probably need some time to think about this, as right now publint focuses on JS file syntax and exports. Expanding to dependencies checking could be nice as a "publish linter". I think it'll be clearer whether this make sense after implementing #13