Provide checksum for NPM packages

[prudloff-insite]

npm-asset packages don't have a shasum property.
This could be added to let Composer check the file was not modified.

For example:

        {
            "name": "npm-asset/cropper",
            "version": "4.1.0",
            "dist": {
                "type": "tar",
                "url": "https://registry.npmjs.org/cropper/-/cropper-4.1.0.tgz",
                "shasum": "3c2faaa78f730a3c71814cee61e17c7a674b943f"
            },
            "require": {
                "npm-asset/cropperjs": ">=1.5.6,<2.0.0"
            },
            "type": "npm-asset",
            "license": [
                "MIT"
            ]
        }