Problem

The shamefully-flatten flag is used too frequently due to issues with eslint, vue, angular and other popular tools that require all subdeps to be hoisted. This is especcially bad because the application code gets access to all those hoisted subdeps.

Proposed solution

Instead of hoisting all dependencies into the project's node_modules, pnpm can use a hidden node_modules that only dependencies will have access to.

Lets see it on an example. The next project has foo in dependencies and foo has bar in dependencies

project
+ node_modules
  + foo -> .pnpm/registry.npmjs.org/foo/1.0.0/node_modules/foo
  + .pnpm
     + node_modules
        + bar -> ../registry.npmjs.org/bar/1.0.0/node_modules/bar
        + foo -> ../registry.npmjs.org/foo/1.0.0/node_modules/foo
     + registry.npmjs.org
        + foo/1.0.0/node_modules/foo
        + bar/1.0.0/node_modules/bar

This can be turned on by default for the new hoist config (see #1997)

cc @KSXGitHub @ExE-Boss @shellscape