* fix: use the same strictSSL default as tls.connect

The better to avoid having to do patches like 771a1cb.

PR-URL: #3664
Credit: @isaacs
Close: #3664
Reviewed-by: @wraithgar

PR-URL: #3681
Credit: @fritzy
Close: #3681
Reviewed-by: @wraithgar

  * fix: Add gitHead in subdirectories too
  * fix(man): don't resolve paths to man files

Somehow the last one didn't take?

  * fix: perf regression on hot string munging path

This corrects two things,

`--global` implies `--location=global` and `--package-lock-only` implies
`--package-lock`

It also introduces a new sandbox runner for testing purposes. it's not
the prettiest thing i've ever written, but it seems to do the job pretty
nicely and doesn't require keeping track of wild shenanigans everywhere.

Fixes #2747
Fixes #3572

PR-URL: #3684
Credit: @nlf
Close: #3684
Reviewed-by: @wraithgar

Order matters here so we clean the more specific things before the
generic ones.

PR-URL: #3687
Credit: @wraithgar
Close: #3687
Reviewed-by: @nlf

  * feat: introduce @npmcli/fs for tmp dir methods