chore(changelog): should link to dependency bug fixes

[lukekarrys]

As is often the case in arborist, a PR will directly fix an issue in npm/cli. Currently the changelog doesn't link those except to the commit/PR that updated the dependency. This makes it difficult to look at a changelog and know which bugs were fixed.

For example: v8.1.1 links to arborist@4.0.2 PR but doesn't make it easy to find that it fixes npm/cli#3881