chore: manage published files via files option (#5659)

Rather than a denylist (`.npmignore`) we can instead use an allowlist
via the `files` option in `package.json`. This makes it much harder to
accidentally include files or folders in the build as you have to
explicitly list the files that will be included.

Fixes #5648.

.npmignore

@@ -1,48 +0,0 @@
-.appveyor.yml
-.gitattributes
-
-# no longer generated, but old checkouts might still have it
-node6
-
-# exclude all tests
-test
-utils/node6-transform
-
-# exclude internal type definitions
-/lib/externs.d.ts
-
-# repeats from .gitignore
-node_modules
-.local-chromium
-.local-firefox
-.dev_profile*
-.DS_Store
-*.swp
-*.pyc
-.vscode
-package-lock.json
-/node6/test
-/node6/utils
-/test
-/utils
-/docs
-yarn.lock
-
-# other
-/.ci
-/examples
-.appveyour.yml
-.cirrus.yml
-.editorconfig
-.eslintignore
-.eslintrc.js
-.travis.yml
-README.md
-tsconfig.json
-experimental
-
-# exclude types, see https://github.com/puppeteer/puppeteer/issues/3878
-/index.d.ts
-
-# don't expose src/ as we ship the generated code in lib/
-/src

package.json

@@ -31,6 +31,12 @@
     "unit-bundle": "mocha --config mocha-config/browser-bundle-tests.js",
     "update-protocol-d-ts": "node utils/protocol-types-generator"
   },
+  "files": [
+    "lib/",
+    "Errors.js",
+    "DeviceDescriptors.js",
+    "index.js"
+  ],
   "author": "The Chromium Authors",
   "license": "Apache-2.0",
   "dependencies": {