no-extraneous-dependencies: autofix

My expectations for this are:

1. it must be configured explicitly via some rule config option, since it makes external modifications
   • i.e., if you use autofix and this rule, it won't attempt installs unless you've enabled it explicitly
2. it calls npm install [package] vs. mutating the package.json directly
   • as such, if it is extraneous and you haven't installed it, you get all the dependencies
3. aforementioned rule config is something like install: 'SE' meaning the fix call is npm i [dep] -SE.

I can imagine changing position on (1) and (3) on account of .npmrc existing. Perhaps its existence qualifies as "explicit config".

Note that this means that if your editor has linter integration and autofix enabled on save, you could npm install simply by adding an import/require statement to code.

Would be pretty sweet. Essentially an alternate ESLint-powered form of npm-install-webpack-plugin at that point.

cc-ing @jfmengels as author of no-extra-deps and @sindresorhus for +1-ing my comment about this on the original rule issue.