[BUG] _auth config in npmrc with unset environment variables should be considered as undefined

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

@company:registry=https://nexus.company.com/
https://nexus.company.com/:_auth=${NPM_AUTH}

With this config in npmrc, when NPM_AUTH is not set in current environment variables, config will get the original string one: ${NPM_AUTH}, when it passing to auth headers, it will be string Bearer ${NPM_AUTH} and failed the server validation.
Seems this behavior is some kind of feature?
https://github.com/npm/cli/blob/6a4bcbaaf12c15041c73914fb3a24389a62f7436/workspaces/config/lib/env-replace.js#L6
https://github.com/npm/npm-registry-fetch/blob/2daa377bf47b33278b723e4d6afcb40131cff437/lib/index.js#L234-L238

My case is, we only need auth when publish packages in CI agent, in the agent, we can get the auth token, in local development this environment variables is unset, when add some company packages(no need auth, internal network), will take the Bearer ${NPM_AUTH} auth headers and failed the server validation.

Expected Behavior

With this config in npmrc, when environment variables is not set, the related field should be considered as undefined.

Steps To Reproduce

No response

Environment

• npm: 9.5.0
• Node.js: v18.14.2
• OS Name: Mac OS 13.2.1
• System Model Name: Macbook Pro
• npm config:

; "project" config from xxx

@xxx:registry = "xxx"
//xxx:_auth = (protected)

; node bin location = /Users/lnwu/n/bin/node
; node version = v18.14.2
; npm local prefix = xxx
; npm version = 9.5.0
; cwd = xxx
; HOME = xxx
; Run `npm config ls -l` to show all defaults.

Start with workspaces/config/lib/env-replace.js at the linked environment replacement logic, then inspect npm-registry-fetch/lib/index.js around the linked authentication handling. Reproduce the npmrc configuration with NPM_AUTH unset and verify that the resulting authentication value is treated as undefined rather than sent literally.