fix: ensure Arborist constructor gets passed around everywhere for pacote

[nlf]

since pacote now requires the Arborist constructor in order to pack a tarball for git dependencies, and that tarball can be packed as part of fetching the packument or the manifest, the easiest solution seemed to be adding the Arborist constructor directly into flatOptions. this gets it sent everywhere consistently with one change instead of having to track down every single call to pacote.

we need to circle back to fix this dependency loop at some point anyway, so this technical debt felt appropriate to buy us the time to do so.

[npm-cli-bot]

no statistically significant performance changes detected

timing results

app-large	clean	lock-only	cache-only	cache-only peer-deps	modules-only	no-lock	no-cache	no-modules	no-clean	no-clean audit
npm@8	51.606 ±5.09	24.987 ±0.09	31.911 ±13.21	27.095 ±2.94	3.856 ±0.03	4.016 ±0.00	3.183 ±0.12	15.974 ±0.07	3.030 ±0.03	4.492 ±0.08
#5634	56.396 ±2.75	25.217 ±0.24	32.550 ±13.27	26.339 ±1.42	3.871 ±0.04	4.013 ±0.05	3.093 ±0.04	16.179 ±0.50	3.129 ±0.05	4.750 ±0.18

app-medium	clean	lock-only	cache-only	cache-only peer-deps	modules-only	no-lock	no-cache	no-modules	no-clean	no-clean audit
npm@8	34.302 ±1.59	18.819 ±0.22	17.166 ±0.05	19.065 ±0.88	3.611 ±0.00	3.530 ±0.06	3.347 ±0.10	11.711 ±0.12	2.973 ±0.03	4.127 ±0.03
#5634	39.580 ±4.17	19.416 ±0.05	17.702 ±0.05	18.617 ±1.02	3.655 ±0.11	3.653 ±0.01	3.344 ±0.01	11.910 ±0.24	2.994 ±0.04	4.260 ±0.06