explicit registry auth / npm-registry-client@4.0.0

Uses a new version of [`npm-registry-client`](https://github.com/npm/npm-registry-client/commits/othiym23/better-registry-handling) that requires credentials to be explicitly be passed in for authed calls. This removes a major coupling point between the two packages and moves `npm-registry-client` that much closer to being freestanding. As a byproduct, also allows the use of registries that are not rooted at `/` (which also means potentially supporting multiple registries per `host:port` combo).

I thought this was going to take me about half an hour to straighten out. :tada:

Tasks:

- [x] update `npm-registry-client` to no longer call `config.{get,set}CredentialsByURI()`
- [x] update `npm-registry-client` calls that take auth to require auth explicitly
- [x] modify `toNerfDart()` (which now is only in npm, thanks to absorbing `npmconf` back into the parent program and decoupling auth from `npm-registry-client`) to leave the registry path alone, but strip off the query, search, and hash parameters
- [x] update npm calls using `npm-registry-client` methods to explicitly pass in auth
- [x] add tests for `toNerfDart()` to ensure it's properly handling new requirements
- [x] add tests for `mapRegistryToURI()` to exercise all its edge cases
- [ ] **[STRETCH]** add tests to npm for all untested `npm-registry-client` methods (finally)
- [x] **[STRETCH]** remove the rest of the dependencies on npm's configuration from `npm-registry-client`
- [x] publish `npm-registry-client@4.0.0`
- [ ] incorporate `npm-registry-client@4` into npm, rebase / squash, and merge

Supplants #6538, fixes npm/npm-registry-client#70 (which means it also fixes #6398), fixes npm/npm-registry-client#77.

/cc @iarna, @indexzero, @mamobyz