vlt package manager support

[rarkins]

Tell us more.

Introduced here: https://blog.vlt.sh/blog/introducing-vlt-and-vsr

It has backwards-compatibility with npm's package.json, e.g. when I run vlt install in a simple npm project then it adds a vlt-lock.json file. In that sense initial support could be similar to pnpm/yarn.

Important for us to understand if the structure of the vlt-lock.json file is stable enough that we won't be "broken" by changes to it too often. Alternatively if parsing of the lock file is exposed by vlt as a JS library then we could use that instead.

There's probably also not much point in us only supporting vlt users who use it as a drop-in npm replacement. It's important to understand and support vlt's method of configuring registries, aliases, vsr, etc.

Cc @darcyclarke