fix(npm): validate lockfile tarball origins

[nathanwhit]

Summary

• validate explicit npm tarball URLs from lockfile package entries against trusted registry origins
• preserve same-origin alternate tarball paths for scoped and custom registries
• allow the standard npm registry origin so configured registry relocation continues to work
• treat empty legacy tarball fields as missing and use the configured default tarball URL
• keep the audit registry-error fixture on a trusted origin while forcing the API failure through a nonexistent path

Details

Resolution snapshot creation now parses explicit lockfile tarball URLs before accepting them. The comparison uses normalized URL origins and accepts either the configured registry or the standard npm registry origin that Deno relocates according to npm configuration. Malformed URLs and unrelated origins are reported as lockfile errors.

The audit --ignore-registry-errors fixture now keeps the generated lockfile and configured registry on the same trusted test origin, while a nonexistent registry path still exercises the audit API error-handling boundary.

Validation

• cargo build -p deno
• cargo build -p test_server
• target/debug/deno fmt --check tests/specs/audit/ignore_registry_errors/__test__.jsonc
• cargo fmt --check --package deno_npm
• cargo test -p deno_npm test_snapshot_from_lockfile -- --nocapture
• cargo test -p deno_npm_installer initializer::tests -- --nocapture
• cargo test -p specs_tests --test specs -- specs::audit::ignore_registry_errors --exact --nocapture
• cargo test -p specs_tests --test specs -- specs::npm::tarball_relocate_to_registry::relocates_tarball_to_configured_registry --exact --nocapture
• cargo check -p deno_npm -p deno_npm_installer --all-targets
• cargo clippy -p deno_npm --all-targets -- -D warnings