workspace @npmcli/config and disable audit on global

[fritzy]

• chore: bring in @npmcli/config as a workspace
• feat: set --no-audit when installing outside of a project (like --global)

This sets --location=project anytime the localPrefix has a package.json. Any Arborist command sets --no-audit when --global isn't set and --location isn't project.

please don't squash

[npm-cli-bot]

found 1 benchmarks with statistically significant performance improvements

• app-large: clean

timing results

app-large	clean	lock-only	cache-only	cache-only peer-deps	modules-only	no-lock	no-cache	no-modules	no-clean	no-clean audit
npm@8	48.491 ±0.70	17.784 ±0.15	15.996 ±0.03	18.402 ±0.86	2.906 ±0.01	2.919 ±0.03	2.380 ±0.06	11.099 ±0.03	2.351 ±0.03	3.339 ±0.00
#5779	39.398 ±3.46	17.018 ±0.01	15.898 ±0.12	18.247 ±0.49	2.945 ±0.07	2.887 ±0.01	2.277 ±0.02	11.118 ±0.08	2.278 ±0.03	3.491 ±0.24

app-medium	clean	lock-only	cache-only	cache-only peer-deps	modules-only	no-lock	no-cache	no-modules	no-clean	no-clean audit
npm@8	29.198 ±2.98	13.830 ±0.05	12.446 ±0.08	13.371 ±0.15	2.605 ±0.01	2.629 ±0.01	2.401 ±0.09	8.542 ±0.04	2.235 ±0.02	3.011 ±0.04
#5779	29.484 ±2.59	13.783 ±0.20	12.288 ±0.08	13.682 ±0.03	2.681 ±0.04	2.684 ±0.01	2.280 ±0.01	8.603 ±0.09	2.160 ±0.01	3.099 ±0.08