fix: Strip UTF-8 BOM before parsing manifest.json/messages.json

[Rob--W]

Fixes #1013.

This PR doesn't require a change in package-lock.json, because I purposefully selected a version of strip-bom that was already depended upon via other dependencies. The latest version (4.0.0) does not differ in functionality compared to the chosen version (3.0.0).

[ExE-Boss]

There are the following ESLint failures (you can apply all suggestions in a bulk commit from the files tab):

[Rob--W]

Thanks @ExE-Boss for pinging me. I fixed it locally with ./node_modules/.bin/eslint --fix tests/unit/test-cmd/test.build.js src/util/manifest.js src/cmd/build.js tests/unit/test-util/test.manifest.js and force-pushed the changes.

[coveralls]

Coverage remained the same at 100.0% when pulling 931cddc on Rob--W:strip-bom into de9fe2c on mozilla:master.

[coveralls]

Coverage remained the same at 100.0% when pulling 4022895 on Rob--W:strip-bom into 0d7e491 on mozilla:master.

[rpl]

@Rob--W would you mind to rebase this PR on top of the current master?
I added an exception in the nsprc file in #1714 (and filed #1713 to remove it as soon as possible) to avoid the CI failure on the "npm audit" step.

[rpl]

Thanks @Rob--W, this looks good to me.