Investigate NSP 663 and 664

[chenba]

Builds on master started failing on 2018-05-16 (starting with https://circleci.com/gh/mozilla-services/screenshots/6792). The failures are from nsp; see output below. We should investigate to see if we can ignore those advisories in .nsprc.

> nsp check -o summary

(+) 2 vulnerabilities found
 Name           Installed   Patched   Path                                                                                              More Info                              
 open           0.0.5       None      [email protected] > [email protected] > [email protected]                                               https://nodesecurity.io/advisories/663 
 stringstream   0.0.5       None      [email protected] > [email protected] > [email protected] > [email protected] > [email protected]   https://nodesecurity.io/advisories/664

[jaredhirsch]

The bugs are in jpm, which appears to only be used in the ./bin/run-addon local development script. I think we're fine to ignore those.

[pdehaan]

Submitted upstream issue to [deprecated] jpm and there is an open PR in sign-addon which may handle the stringstream issue (maybe).