getRequested: look also at optDeps when determining package spec

If the shrinkwrap code calls `getRequested` on an optional dependency,
the `spec` passed to `npa.resolve` is null. `npa.resolve` then thinks
it's a request `fromRegistry`, with spec defaulting to `latest`. And
in case the real spec is a tarball, returns nonsensical result where
`isRegistry` is true, `fetchSpec` is `1.0.0` instead of `file:...` and
the record written to the shrinkwrap is wrong. It contains a `resolved`
field, which should be used only for packages downloaded from the registry.

lib/install/get-requested.js

@@ -7,6 +7,8 @@ module.exports = function (child, reqBy) {
   if (!reqBy) reqBy = child.requiredBy[0]
   const deps = reqBy.package.dependencies || {}
   const devDeps = reqBy.package.devDependencies || {}
+  const optDeps = reqBy.package.optionalDependencies || {}
   const name = moduleName(child)
-  return npa.resolve(name, deps[name] || devDeps[name], reqBy.realpath)
+  const spec = deps[name] || devDeps[name] || optDeps[name]
+  return npa.resolve(name, spec, reqBy.realpath)
 }

test/tap/install-dep-classification.js

@@ -126,7 +126,7 @@ test('optional dependency identification', function (t) {
           optional: true
         },
         example: {
-          version: '1.0.0',
+          version: 'file:../example-1.0.0.tgz',
           optional: true
         }
       }
@@ -150,7 +150,7 @@ test('development dependency identification', function (t) {
           dev: true
         },
         example: {
-          version: '1.0.0',
+          version: 'file:../example-1.0.0.tgz',
           dev: true
         }
       }
@@ -173,7 +173,7 @@ test('default dependency identification', function (t) {
           optional: true
         },
         example: {
-          version: '1.0.0',
+          version: 'file:../example-1.0.0.tgz',
           optional: true
         }
       }