feat!: require explicit vue-loader@legacy for Vue 2, remove hidden install

[ShGKme]

Current approach

Currently webpack-vue-config supports both Vue 2 (with vue-loader@15) and Vue 3 (with vue-loader@17) via a postinstall script.

In Vue 2 projects it replaces vue-loader@17 with required vue-loader@15 by installing it with --no-save.

In other words, there might be no vue-loader specified in package.json and an incorrect version specified in package-lock.json while everything magically works.

New approach (breaking change)

No more hidden install. In Vue 2 apps a developer MUST install the required vue-loader manually.

npm i -D vue-loader@legacy

Motivation

This postinstall is a bit hacky. It is intended since there is no other way to have conditional dependencies. For example, popular vue-demi package does something similar.

However, it doesn't work in environments where only explicitly specified in the package-lock.json dependencies are installed. For example, nixpkgs.

cc @provokateurin

Making migration simpler

postinstall script is kept only for the version checking and showing a warning.

Otherwise there is no npm ci error, and the build error might be less obvious.

[ShGKme]

Changes in the force-push:

• Rebased onto main
• Added a test for the Vue 2 + incompatible vue-loader
• Simplified version checking (only check package.json, do not load entire Vue module)
• In case of version check error - just skip the check

The last one change is important.

The purpose of the script is to warn in a simple way about an incompatible vue-loader version.
If something goes wrong, just skip the check (for example, nixpkgs or other unusual setups might run postinstall when dependencies are not installed as expected by npm).
In case of incompatibility, an error will be raised when using the package anyway, just less directly - with compilation errors.

cc @provokateurin

State changed

[ShGKme]

• Added the new test files to REUSE

[ShGKme]

@DorraJaouad Also adding you as it is kind of a security issue. Currently vue-loader and its dependencies may not be listed in the package-lock file at all. This PR makes it required via a small breaking change.

• Related (we now check it on CI): https://github.com/grant-dennison/npm-package-lock-add-resolved