Fixes registry used to check for deprecation settings

[arcanis]

What's the problem this PR addresses?

The new yarn npm audit implementation checks the packages' metadata on the audit server rather than the server configured to serve their metadata.

Closes #5533

How did you fix it?

Updated the code to use the new getPackageMetadata function, which should use the proper server while also leveraging the cache if possible.

Checklist

• I have read the Contributing Guide.

• I have set the packages that need to be released for my changes to be effective.

• I will check that all automated PR checks pass before the PR gets reviewed.

[merceyz]

Needs a test and getPackageMetadata doesn't include the deprecated field.
#5491 (comment)

[paul-soporan]

Deprecations shouldn't use getPackageMetadata - even if we cached the deprecated field, it could be stale for exact versions since it can change at any time.

[arcanis]

even if we cached the deprecated field, it could be stale for exact versions since it can change at any time

In which case I'd expect the registry to fail the etag / last modified check and return the updated metadata. I don't pass a version number, so we should never return straight from the cache.

I didn't notice that the deprecated field wasn't cached though - I'm thinking of adding it, as having a working cache on audit should make it much faster - the deprecation check is currently the slower part.