Verifies npm package tarball authenticity and integrity

[grzuy]

closes #42

[grzuy]

Pending adding a few test cases.

Waiting to see if added here or in separate package.

[josevalim]

Beautifully done, thank you! :green_heart: :blue_heart: :purple_heart: :yellow_heart: :heart:

[grzuy]

Will take a look at the CI issue with elixir 11. Maybe update ci versions also.