Fix scoped packages publish behavior

[mothershipper]

Had three issues here:

• The docs suggested scoped packages would be published as private,
  however this behavior was changed in c3976bf
• The docs show config to be added to the package.json, which can be
  easily misunderstood as what needs to be added to the .release-it.json
  file (all the other examples reference the release-it config)
• The links in the docs were dead

This commit reverts the behavior introduced by c3976bf because the
behavior is surprising and dangerous.

It also updates the documentation to fix the links and show how to
configure release-it first (before the note about a package.json file).

[webpro]

Thanks, @mothershipper! Much appreciated. I totally agree it's best to leave as much as possible to npm itself and configure things where appropriate. I once introduced the npm.access option to the release-it config, and that should not have happened in the first place. I also don't have a paid npm account, making things more complicated here.

I'm going to merge your changes and take it from there. I think it fixes things so don't consider this a breaking/major update.

[webpro]

Now I also see what confused me in the past. The documentation at https://docs.npmjs.com/about-scopes still says:

Scoped packages are private by default; you must pass a command-line flag when publishing to make them public.

But this isn't true. Adding publishConfig.access: "public" to package.json also works.

So I guess it's best to deprecate npm.access in the release-it config altogether.

[mothershipper]

Thanks @webpro, this fix is going to help us migrate over to automated releases :)

I'm not sure that there are any other differences between the free and paid versions of NPM, but I'm happy to help test changes if you need it!

[webpro]

Thanks a lot for taking the time to dive into this and open a PR including tests. Great stuff!