fix: handle scoped package names in array dependencies

[afonsojanu]

Fixes #105.

depObjectify (used when dependencies/devDependencies/optionalDependencies is given as an array of strings instead of an object) splits each entry on the first @, whitespace, >, <, or =, treating whatever comes before as the package name and the rest as the version range.

For a scoped package like "@babel/core@^7.0.0", the leading @ that marks the scope gets picked up by that same split, so the parsed name ends up being an empty string and the version range ends up as "babel/core@^7.0.0" (the actual version got lost inside it). That matches exactly what's in the issue's screenshot and the 400 error from the registry.

Fix: strip a leading @ before splitting (so it isn't mistaken for the name/version separator), then add it back to the parsed name afterward. Verified against the exact case from the issue:

normalize({ name: 'x', version: '1.0.0', dependencies: ['@babel/core@^7.0.0', 'lodash@^4.17.0'] }, warn)
// before: { '': 'babel/core@^7.0.0', lodash: '^4.17.0' }
// after:  { '@babel/core': '^7.0.0', lodash: '^4.17.0' }

Added a test covering this in test/dependencies.js. Full suite (69 tests) and lint both pass.