Move bundled NPM deps
    
    If a user does `npm -g update npm` (not recommended), they can
    dangerously clobber their system because it will remove the
    .bundled directory. This patch moves it to a safer location.
    
    Resolves: rhbz#1565256
    
    Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>