npm / arborist / #237

push

Use @npmcli/metavuln-calculator for faster audits

This makes the AuditReport calculation around 40% faster in the cold
cache state, and anywhere from 90% to 99% faster with a warm cache.

It also sets the stage for the capability of doing audits without
hitting the registry, and potentially avoiding known-vulnerable package
versions if they've been previously marked and cached as vulnerable.
(This additional functionality is not implemented in this change, but
it's something we can do in the future.)

One impact is that the `Vuln` class now has an `advisories` set, as well
as a `via` set.  `vuln.advisories` is a set of advisories created by the
metavuln-calculator, which can represent either actual advisories or
metavulns.  The `via` set is a list of Vuln objects _only_, so that we
can track fixes and report on them comprehensively.

Fix: https://github.com/npm/arborist/issues/109

2227 of 2227 branches covered (100.0%)

Branch coverage included in aggregate %.

3254 of 3254 relevant lines covered (100.0%)

355.76 hits per line