feat: add --replace-registry-host=<npmjs|always|never>

[fritzy]

Dist references in a lockfile currently have their host replaced with the configured registry when it is https://registry.npmjs.org, but not otherwise. Between this PR and a pacote PR, we added the options or never replacing the host or always replacing the host, in addition to the current behavior of npmjs.

[npm-robot]

no statistically significant performance changes detected

timing results

app-large	clean	lock-only	cache-only	cache-only peer-deps	modules-only	no-lock	no-cache	no-modules	no-clean	no-clean audit
npm@8	46.239 ±0.27	27.311 ±0.06	15.097 ±0.08	17.688 ±0.80	2.484 ±0.06	2.415 ±0.02	1.937 ±0.06	10.058 ±0.05	1.886 ±0.04	2.912 ±0.05
#4860	47.964 ±2.48	33.293 ±8.26	31.379 ±21.79	18.308 ±1.20	2.519 ±0.01	2.522 ±0.00	1.990 ±0.00	10.152 ±0.03	1.979 ±0.00	3.040 ±0.22

app-medium	clean	lock-only	cache-only	cache-only peer-deps	modules-only	no-lock	no-cache	no-modules	no-clean	no-clean audit
npm@8	43.285 ±14.62	20.209 ±0.02	10.852 ±0.00	11.769 ±0.10	2.289 ±0.03	2.309 ±0.02	2.055 ±0.01	7.531 ±0.00	1.897 ±0.02	2.637 ±0.04
#4860	34.733 ±1.57	21.350 ±0.14	11.447 ±0.04	12.078 ±0.18	2.295 ±0.02	2.289 ±0.00	2.062 ±0.07	7.419 ±0.12	1.883 ±0.00	2.632 ±0.06

[nlf]

this looks good, but i did see one thing that may cause an issue for some folks

[everett1992]

--replace-registry-host=always will have confusing behavior when part of the pathname belongs to the registry e.g.

# package lock created with registry=https://registries.biz/customer1
resolved=https://registries.biz/customer1/pkg/-/pkg-1.0.0.tgz

# package lock read with registry=https://registries.biz/customer2 replace-registry-host=always
resolved=https://registries.biz/customer2/customer1/pkg/-/pkg-1.0.0.tgz
                                          ^-------- Oh no!

Please consider the record-default-registry option from #4264 which tries to address a similar issue as this PR.

[darcyclarke]

@fritzy what's the state of this PR?

[fritzy]

--replace-registry-host can also be a bare host name like registry.npmjs.org.

[npm-cli-bot]

no statistically significant performance changes detected

timing results

app-large	clean	lock-only	cache-only	cache-only peer-deps	modules-only	no-lock	no-cache	no-modules	no-clean	no-clean audit
npm@8	39.439 ±6.25	18.838 ±0.19	16.472 ±0.07	19.606 ±1.15	2.829 ±0.02	2.832 ±0.03	2.380 ±0.02	11.304 ±0.00	2.264 ±0.00	3.297 ±0.02
#4860	38.232 ±2.37	19.386 ±0.06	16.879 ±0.10	19.748 ±0.63	3.007 ±0.11	2.835 ±0.04	2.285 ±0.00	11.483 ±0.04	2.283 ±0.02	3.436 ±0.19

app-medium	clean	lock-only	cache-only	cache-only peer-deps	modules-only	no-lock	no-cache	no-modules	no-clean	no-clean audit
npm@8	27.032 ±0.88	14.100 ±0.05	12.463 ±0.04	13.884 ±0.21	2.591 ±0.01	2.581 ±0.00	2.271 ±0.00	8.183 ±0.02	2.186 ±0.00	2.962 ±0.00
#4860	26.586 ±0.22	14.287 ±0.06	12.511 ±0.02	13.423 ±0.21	2.626 ±0.01	2.661 ±0.03	2.293 ±0.02	8.337 ±0.00	2.194 ±0.00	3.229 ±0.39

[darcyclarke]

@fritzy did we investigate @everett1992's question & PR? (ie. #4264) Just want to make sure all concerns here are resolved before we add this support

[fritzy]

@darcyclarke yeah, this was broken up into a previous PR with his work in it. This is a separate piece.

[nlf]

ok one last thing that needs to be tweaked then i can land this!