Restores ability to update packages using `--depth` as suggested by `npm audit`.

i.e `npm update eslint-utils --depth 2`.

PR-URL: #239
Credit: @G-Rath
Close: #239
Reviewed-by: @claudiahdz

This reverts commit 45772af

Fix: https://npm.community/t/6-11-1-some-dependencies-are-no-longer-being-installed/9586/4

Also adds 2 tests to verify regression behavior.

PR-URL: #242
Credit: @isaacs
Close: #242
Reviewed-by: @claudiahdz

Re: https://npm.community/t/6-11-2-npm-ci-installs-package-with-wrong-permissions/9720

Still passing a plain old (non-Figgy Pudding) object into libcipm,
duplicating the extra keys added in figgy-config.js.

This is not a clean or nice or elegant solution, but it works, without
regressing the config env var issue.

Pairing with @claudiahdz

PR-URL: #243
Credit: @isaacs
Close: #243
Reviewed-by: @claudiahdz