Epic

pacote supports allow-git allow-remote, etc to limit fetching from non-registry endpoints. npm needs an aggregate flag so folks can configure them in one place.

This will be --allow-type with the values being a loose mapping to npm-package-arg types (registry will be an analog for version/range/tag).