no-extraneous-dependencies: autofix

My expectations for this are:
1. it must be configured explicitly via some rule config option, since it makes external modifications
- i.e., if you use autofix and this rule, it won't attempt installs _unless_ you've enabled it explicitly
2. it calls `npm install [package]` vs. mutating the `package.json` directly
- as such, if it is extraneous _and_ you haven't installed it, you get all the dependencies
3. aforementioned rule config is something like `install: 'SE'` meaning the fix call is `npm i [dep] -SE`.

I can imagine changing position on (1) and (3) on account of [`.npmrc`](https://docs.npmjs.com/files/npmrc) existing. Perhaps its existence qualifies as "explicit config".

Note that this means that if your editor has linter integration and autofix enabled on save, you could `npm install` simply by adding an import/require statement to code.

Would be pretty sweet. Essentially an alternate ESLint-powered form of [npm-install-webpack-plugin](https://github.com/ericclemmons/npm-install-webpack-plugin) at that point.

cc-ing @jfmengels as author of `no-extra-deps` and @sindresorhus for +1-ing my comment about this on the original rule issue.

Start by reviewing the no-extraneous-dependencies rule and the original rule issue referenced in the discussion, then compare the proposed behavior with npm install and .npmrc configuration. Done means an explicitly controlled autofix can install the missing dependency with the requested options, while preserving the stated dependency behavior.

Written by the indexing model from the issue text.