fixes the symlinks problem isaacs#3 while not causing the TOCTOU vulnerability isaacs#14

The [patch in libuv 1.21.0](https://github.com/libuv/libuv/releases/tag/v1.21.0) that undeprecates `fs.lchown` [has been incorporated in nodejs Version 10.6.0](https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V10.md#2018-07-04-version-1060-current-targos).

So I specified the minimum nodejs version in `package.json` with the `engine` key: https://docs.npmjs.com/files/package.json#engines

see: https://docs.travis-ci.com/user/languages/javascript-with-nodejs/#specifying-nodejs-versions

in the process:
- update that list to match the maintained Node versions
  see: https://github.com/nodejs/Release#release-schedule
- remove the constraint on the npm version (I dont' see why the default npm would not work)

references:
- https://www.jeffgeerling.com/blog/2018/how-i-test-ansible-configuration-on-7-different-oses-docker
- https://hub.docker.com/_/node/