Update npm 5.6.0

https://github.com/nodejs/node/pull/17535 directly targeted v9.x-staging as npm 5.6.0 explicitly fails on 10.x (and thus fails on master)

This PR cherry-picks the original 5.6.0 upgrade from the 9.x-staging branch and includes a floated patch to force npm support on 10.x. I would not like to see master falling behind a release stream for vendored dependencies.

Didn't want to block updating the release so I've moved the conversation here

@zkat @iarna do you have any objections to us doing this?