feat(npm-cli): add npmAuditRegistry config option

[jdanil]

What's the problem this PR addresses?

yarn npm audit fails when using artifactory as a registry and when no recommendations are available.

Closes #3520.
Closes #3569.

How did you fix it?

Introduced a new npmAuditRegistry config option. On further testing against an artifactory server, I found that npm was also erroring out.

npm v6 throws...

npm ERR! code ENOAUDIT
npm ERR! audit Your configured registry (https://artifactory.mycompany.com/artifactory/api/npm/npm-repository-name/) may not support audit requests, or the audit endpoint may be temporarily unavailable.

npm v7 throws...

npm WARN audit 500 Internal Server Error - POST https://artifactory.mycompany.com/artifactory/api/npm/npm-repository-name/-/npm/v1/security/audits/quick
{
  errors: [
    {
      status: 500,
      message: 'Repo is offline. Cannot use the HTTP client.'
    }
  ]
}
npm ERR! audit endpoint returned an error

We still want to default to using the custom registry as using a public registry may unintentionally leak private information. It also seems that private registries can modify the generated reports before responding to the request (https://jfrog.com/blog/protect-your-code-with-npm-audit-jfrog-xray/).

If the private registry does not support audit, we know that the default registries do. This provides an escape hatch for users to configure a custom audit registry.

Also added a null check to advisory recommendations to protect against the case where a patch does not yet exist.

Also updated the auth type to BEST_EFFORT as suggested by @ejsmith03. It looks like the public registries work regardless, and this also bypasses the Invalid authentication (as an anonymous user) error returned by the private registry.

Checklist

• I have read the Contributing Guide.

• I have set the packages that need to be released for my changes to be effective.

• I will check that all automated PR checks pass before the PR gets reviewed.

[jdanil]

With this change clipanion will simply print Recommendation: null if a recommendation is not provided.

[arcanis]

Good work!