Sanitize package.json

[chenglou]

https://github.com/facebook/reason/blob/f7ba08b1b3b2e152d7d4f0b6bfe776008f780978/package.json#L49

This caused a duplicate merlin install (which might fail the compilation for npm-opam packages). The problems is that npm-opam/merlin resolves to https://github.com/npm-opam/merlin.git, which we use elsewhere. However, https://github.com/npm-opam/merlin.git and https://github.com/npm-opam/merlin are not the same.

We can warn related issues every time to run rebel (and it'll stay performant! No check done if package.json didn't change. Muahahahah Jenga). In general we can just throw all the package.json validation into Rebel I think.