feat: implement new npm-packlist behavior

[lukekarrys]

This also lands the latest pacote which now requires passing in an
Arborist constructor for use in loading the package tree that gets
passed to npm-packlist.

BREAKING CHANGE: npm pack now follows a strict order of operations
when applying ignore rules. If a files array is present in the
package.json, then rules in .gitignore and .npmignore files from the
root will be ignored.

[lukekarrys]

This is a draft until npm/pacote#204 lands and is published. Currently this PR has the same behavior installed in node_modules from a tarball from that PR.

This is ready

[npm-cli-bot]

found 20 benchmarks with statistically significant performance improvements

• app-large: clean, lock-only, cache-only, cache-only:peer-deps, modules-only, no-lock, no-cache, no-modules, no-clean, no-clean:audit
• app-medium: clean, lock-only, cache-only, cache-only:peer-deps, modules-only, no-lock, no-cache, no-modules, no-clean, no-clean:audit

timing results

app-large	clean	lock-only	cache-only	cache-only peer-deps	modules-only	no-lock	no-cache	no-modules	no-clean	no-clean audit
npm@8	43.042 ±2.17	18.694 ±0.21	16.849 ±0.10	22.225 ±4.89	3.045 ±0.10	3.022 ±0.04	2.491 ±0.05	11.451 ±0.01	2.436 ±0.02	3.928 ±0.70
#5602	0.111 ±0.00	0.110 ±0.00	0.111 ±0.00	0.113 ±0.00	0.108 ±0.00	0.110 ±0.00	0.110 ±0.00	0.109 ±0.00	0.109 ±0.00	0.109 ±0.00

app-medium	clean	lock-only	cache-only	cache-only peer-deps	modules-only	no-lock	no-cache	no-modules	no-clean	no-clean audit
npm@8	31.366 ±0.14	14.424 ±0.13	12.970 ±0.09	13.576 ±0.11	2.727 ±0.03	2.689 ±0.00	2.461 ±0.00	8.904 ±0.09	2.294 ±0.00	3.137 ±0.03
#5602	0.110 ±0.00	0.111 ±0.00	0.110 ±0.00	0.108 ±0.00	0.109 ±0.00	0.110 ±0.00	0.109 ±0.00	0.110 ±0.00	0.111 ±0.00	0.110 ±0.00