update npm to 5.8.0

Another attempt after https://github.com/nodejs/node/pull/19560 broke master. Because npm removed node-gyp we now need to vendor it. I've added it to tools/node_modules similar to our other vendored dependencies. I've also gone ahead and make a script to update the dep, update the license builder, update the license, and update the Makefile.

I'm going to run CITGM on this... I'm curious if this will have any effect on native modules at all.

/cc @iarna why did y'all remove node-gyp, and are there any edge cases we should expect?