Move nsp check from prepare to an optional script

[lance]

Instead, we should just echo a message in prepare. E.g.

"prepare": "echo 'To confirm CSV compliance, run 'npm run security-check'",
"security-check: nsp check"

or something...