Package Version Creation - all dependencies are installed for AllUsers

### Summary
We have a package with dependencies on other packages. We want to create a new `PackageVersion`.

One of the dependencies has a custom permission (to disable triggers) that we DO NOT want added to every profile in an org.

Creation of a package version "installs" the dependencies in that ephemeral creation system with `AllUsers` and we know this because version creation fails with errors that only happen if the triggers in our package are disabled.

### Steps To Reproduce

We have a repository but it is private for Department of Veterans Affairs. Please contact me for a demo.

1. Create a package that contains a Custom Permission (`Package1`)
1. Create a second package dependent on the first (`Package2`).
- Write a trigger in `Package2` that exits if the flag is on the user's profile, and does something if that flag is not present.
- Write a test that verifies that a trigger that references that bypass flag fires if the user does not have the flag
1. Create a package version of `Package2`

### Expected result
The docs say that packages install with `AdminsOnly` by default, so it is expected that the package version can be created.

### Actual result
Package version creation fails because no trigger tests pass because `Package1` put the bypass custom permission on every profile.

### System Information
OSX zsh in VSCode

```json

{
"architecture": "darwin-arm64",
"cliVersion": "@salesforce/cli/2.51.6",
"nodeVersion": "node-v20.15.0",
"osVersion": "Darwin 23.5.0",
"rootPath": "/Users/dschach/.local/share/sf/client/2.51.6-e49d0be",
"shell": "zsh",
"pluginVersions": [
"@oclif/plugin-autocomplete 3.1.7 (core)",
"@oclif/plugin-commands 4.0.7 (core)",
"@oclif/plugin-help 6.2.6 (core)",
"@oclif/plugin-not-found 3.2.11 (core)",
"@oclif/plugin-plugins 5.3.7 (core)",
"@oclif/plugin-search 1.2.3 (core)",
"@oclif/plugin-update 4.4.9 (core)",
"@oclif/plugin-version 2.2.8 (core)",
"@oclif/plugin-warn-if-update-available 3.1.9 (core)",
"@oclif/plugin-which 3.2.8 (core)",
"@salesforce/cli 2.51.6 (core)",
"apex 3.2.5 (core)",
"auth 3.6.36 (core)",
"data 3.5.5 (core)",
"deploy-retrieve 3.9.17 (core)",
"dev 2.3.6 (user) published 5 days ago (Fri Jul 19 2024)",
"info 3.3.18 (core)",
"limits 3.3.18 (core)",
"marketplace 1.2.18 (core)",
"org 4.3.5 (core)",
"packaging 2.7.1 (core)",
"schema 3.3.19 (core)",
"settings 2.3.8 (core)",
"sobject 1.4.19 (core)",
"source 3.5.5 (core)",
"telemetry 3.6.2 (core)",
"templates 56.3.3 (core)",
"trust 3.7.13 (core)",
"user 3.5.18 (core)",
"@salesforce/sfdx-scanner 4.3.2 (user) published 21 days ago (Wed Jul 03 2024)"
]
}
```
### Additional information
FEATURE REQUEST:
- Flag on each package dependency in sfdx-project.json to specify if that dependency should be installed with `AdminsOnly`, `AllUsers`, or (maybe) an array of profile names
- Flag on package version create that forces all dependent packages to be installed in that creation org with a specific `security-type`

It even fails if I put a profile in `unpackagedMetadata`, and I don't want to have to package a profile in `Package2` if I don't have to.