Fix PNPM issues with private registries

[deivid-rodriguez]

This PR fixes two issues:

• Dependabot can't infer the proper registry for each dependency by looking at registry urls in pnpm-lock.yaml.

This is handy because developers don't need to commit a .npmrc file and matches what we already support for NPM and Yarn.

• Dependabot incorrectly tries to infer the proper registry for each dependency by looking at presence in the registry, even when registries & scopes are explicitly configured in .npmrc.

This is a good last resort fallback, but it should not be used if registries & scopes have been explicitly configured.

Fixes #8242.
Fixes performance issues introduced by #8094.
Likely to fix #8008.

[yeikel]

Thank you for tagging me!

I am not too familiar with the ecosystem but I understand the problem. Any chance you can add a spec?

[deivid-rodriguez]

Actually I meant to ping @mburumaxwell 🤦‍♂️, sorry about that. Thanks for chiming in though! Yes, this is a draft because I plan to add some specs 👍.

[deivid-rodriguez]

@dancallaghan This is now ready, I'll deploy it next week!

[deivid-rodriguez]

Thanks for reviewing @yeikel, hopefully I addressed your comments.

@dancallaghan If you're able to try this again, I appreciate. I introduced a few refactoring so it'd be good to know I did not break anything!

[dancallaghan]

Thanks @deivid-rodriguez

I've tested locally with the latest changes on our use case and it's working as expected 👍

[BPScott]

@deivid-rodriguez, It seems like the changes to the lockfile in pnpm v9 mean these improvements no longer apply.

The performance issues caused by dependabot checking non-standard repositories for all packages rather than the ones within configured namespaces have resurfaced when using pnpm v9

Dependabot seems to want to check all packages against my private repository rather than only once in the given namespace - the same as #8242 (comment)

[deivid-rodriguez]

I no longer actively contribute to this repo, so I won't be able to help right now, but thanks for letting me know!