fix: reject leading hyphens (#156)

<!-- What / Why -->
<!-- Describe the request in detail. What it does and why it's being
changed. -->

Reject unscoped names with leading hypens (dashes). These package names
are often interpreted as options on the command-line.

## References
<!-- Examples:
  Related to #0
  Depends on #0
  Blocked by #0
  Fixes #0
  Closes #0
-->

https://en.wikipedia.org/wiki/Hyphen-minus (I usually call them dashes)

Author: hashtagchris

lib/index.js

@@ -34,6 +34,10 @@ function validate (name) {
     errors.push('name cannot start with a period')
   }
 
+  if (name.startsWith('-')) {
+    errors.push('name cannot start with a hyphen')
+  }
+
   if (name.match(/^_/)) {
     errors.push('name cannot start with an underscore')
   }

test/index.js

@@ -7,6 +7,7 @@ const validate = require('..')
 test('validate-npm-package-name', function () {
   // Traditional
 
+  assert.deepStrictEqual(validate('validate-npm-package-name'), { validForNewPackages: true, validForOldPackages: true })
   assert.deepStrictEqual(validate('some-package'), { validForNewPackages: true, validForOldPackages: true })
   assert.deepStrictEqual(validate('example.com'), { validForNewPackages: true, validForOldPackages: true })
   assert.deepStrictEqual(validate('under_score'), { validForNewPackages: true, validForOldPackages: true })
@@ -34,6 +35,11 @@ test('validate-npm-package-name', function () {
     validForOldPackages: true,
   })
 
+  assert.deepStrictEqual(validate('@user/-package'), {
+    validForNewPackages: true,
+    validForOldPackages: true,
+  })
+
   assert.deepStrictEqual(validate('@user/_package'), {
     validForNewPackages: true,
     validForOldPackages: true,
@@ -91,6 +97,16 @@ test('validate-npm-package-name', function () {
     validForOldPackages: false,
     errors: ['name cannot start with an underscore'] })
 
+  assert.deepStrictEqual(validate('-start-with-hyphen'), {
+    validForNewPackages: false,
+    validForOldPackages: false,
+    errors: ['name cannot start with a hyphen'] })
+
+  assert.deepStrictEqual(validate('--start-with-double-hyphen'), {
+    validForNewPackages: false,
+    validForOldPackages: false,
+    errors: ['name cannot start with a hyphen'] })
+
   assert.deepStrictEqual(validate('contain:colons'), {
     validForNewPackages: false,
     validForOldPackages: false,