feat(ls): support --package-lock-only flag to enable using the virtual tree

[G-Rath]

Adds support for passing --package-lock-only to npm list to have it load the tree virtually from the package-lock.json rather than the actual tree (from node_modules).

This is useful for tooling where you want to explore the tree as it's laid out in package-lock.json i.e for auditing, since npm audit describes the tree virtually. For example if you're on a Windows or Linux machine, npm audit can report fsevents > ini as being vulnerable but npm list ini wouldn't show the dependency since it's not in the physical tree. npm list ini --package-lock-only on the other hand will.

This also means that these tools don't need to be able to do a valid npm install (which can be costly), since the virtual tree doesn't require node_modules to exist.

I've implemented some basic tests based on the existing ones, but have not done so for all possible permutations of flags as I felt that could be overkill and I don't have a deep enough knowledge on package-lock.json to confidently create all the package-lock.json equivalents of the node_modules required for each test.

I also couldn't figure out where to update the documentation, as there's tags saying not to edit manually but I couldn't find where they were actually generated from.

References

Resolves #3068
Superseeds #3404

[isaacs]

We already have the --package-lock-only flag, let's use that instead of creating yet another config. Just update the description in the config definitions to say how it's used by ls. (Also, --virtual is a little bit implementation-details-ish.)

Otherwise, this looks great!

[G-Rath]

@isaacs completely agree, that's a much better flag to use - I've switched to using that; let me know if the documentation describe is suitable - happy to make changes if you have a better one in mind :)

[wraithgar]

This looks great, thanks!