What is bulk audit and how does it differ from the endpoint that we currently use?

The best public documentation about the bulk audit endpoint is here: https://docs.npmjs.com/cli/v11/commands/npm-audit#audit-endpoints. The bulk audit endpoint is a newer, simpler endpoint that takes a list of dependencies and versions instead of an entire tree.

Originally, I thought migrating to the bulk audit endpoint would be necessary for the audit command to support updating packages directly in the lockfile instead of adding overrides. However, I realized this isn't true, so I started a new PR which adds audit update support without changing the audit endpoint. I think that is a better place to start, so I will close this in favor of the new PR #10341

It likely does make sense to add the ability to use the bulk audit endpoint as well, but that can be done after.