include auth with tarball requests from shrinkwrapped installs

This is a tiny bit hacky, but for private registries using scopes and tarball auth, it will ensure that the bearer token / basic auth credentials are passed for tarball dependencies when all the credentials are properly configured. See `test/tap/shrinkwrap-scoped-auth.js` for details of how the configuration should look.

/cc @aledbf @rlidwka for review / info