[BUG] npm audit - explain and show data send to the registry

Hey, according to the docs:

The audit command submits a description of the dependencies configured in your project to your default registry and asks for a report of known vulnerabilities. (...)

However, this does not state clearly the exact data sent to the registry.

This, along with a lack of an "offline mode" and the fact that some private npm registries may not support audit requests:

$ npm audit
npm ERR! code ENOAUDIT
npm ERR! audit Your configured registry (<some registry URL>) does not support audit requests

may end up with people using the --registry=https://registry.npmjs.org flag and sending potentially sensitive data to a public registry.

It would be great to:

1. Extend the npm audit documentation so it clearly states what exact data is sent (package.json? package-lock.json? just list of dependencies with their versions?)
2. Adding a --dry-run option to the npm audit command, so it shows the data that will be sent.
3. Making npm audit fail if it gets an unrecognized option, so it does not send a request if someone mistakenly do npm audit --halp
4. (Wishful thinking?) Have an --offline mode

Start with the linked npm audit documentation and the npm audit command behavior described in the issue. Determine which request data is sent, how unrecognized options are handled, and whether dry-run or offline behavior is feasible; done means the agreed scope is documented and verified without sending unintended data.