npm / arborist / #900

push

Prevent and eliminate unnecessary duplicates

When the root package tree bundles its dependencies, previously Arborist
would treat that as a normal bundled dependency (rather than a
transitive dependency bundled _by_ a dependency) and refuse to touch it.

This resulted in a strange situation where npm would stubbornly refuse
to modify the copy of npm-registry-fetch nested underneath its pacote
dependency, even when pacote or nrf were updated explicitly, requiring
the deletion of the node_modules tree in order to resolve properly.

A `canDedupe()` method is added to the Node class, and this is used in
multiple previously (slightly) duplicative code paths where we test to
see if we can dedupe out a nested Node in the tree, thus both preventing
and correcting the unnecessary duplicates that would otherwise have
occurred.

This does introduce the bug/feature/change where now installing a new
package at the top level will cause npm to remove anything nested within
the tree that could be deduped against it, as long as that nested
transitive dependency is not contained in a dep bundle or shrinkwrap.

2987 of 2987 branches covered (100.0%)

Branch coverage included in aggregate %.

4041 of 4041 relevant lines covered (100.0%)

563.15 hits per line