Running composer update should not trigger npm update

[ezzatron]

I've come to realise that the management of NPM dependency updates shouldn't really be a concern of composer-npm-bridge, which should just focus on installation of dependencies instead.

It's fairly obvious when you think about it - you might only want to update Composer dependencies without it affecting your NPM dependencies, and you should be free to do so.

This also allows package maintainers to use alternative package managers like Yarn if they so choose (although dependencies will still be installed with npm for the time being).