[RRFC] npmrc file improvements.

There are two current problems that I see with npmrc files,

1. They're very suseptable to mismatch as they follow a format of

   @scope=${URL}
   ${URL}/:_authToken=${TOKEN}
   

   This means you put in the URL twice, and it's not clear exactly that it's a URL to begin with. You can see this bug here where I just suffered from this problem. https://github.com/npm/cli/issues/3618

2. They do not differentiate between push and pull end-points which is need by CI tools like GitLab. Currently, GitLab hosts their npm registry on an unprivledged port 5050. When you pull from packages this is what you're supposed to pull from. When you push packages you're supposed to submit to their privileged V4 Package API (which itself is interfaced with like a registry). You can see in their official docs they create a .npmrc file with,

   @foo:registry=https://gitlab.example.com/api/v4/projects/${CI_PROJECT_ID}/packages/npm/
   //gitlab.example.com/api/v4/projects/${CI_PROJECT_ID}/packages/npm/:_authToken=${CI_JOB_TOKEN}
   

   I suspect strongly the reason why they do NOT use the unprivledged $CI_REGISTRY (and instead use $CI_SERVER_HOST in their examples) in the top is because if they did, it would expand with the port number to acme.net:5050 and thus mismatch with the auth line below. But ideally what they want is the ability for both people with and without publishing rights to pull from the unprivledged port 5050, and to push to the privledged https://gitlab.example.com/api/v4 (or $CI_API_V4_URL)

   What would be ideal here is .npmrc supported something more like this,

   "@scope": {
     "push": {
       repoUrl: $url,
       authToken: $token
     }
     "pull": {
       repoUrl: $url,
       authToken: $token
     }
   }
   

   Then you could never mismatch the token's connection to the scope, or the repo url. And GitLab could permit users internal and exteral to pull from the unprivledged port 5050 repo, regardless of whether or not they intend to publish later. And, without rewriting their npmrc after they pull to support pushing.

Start with the npmrc examples in this RFC, npm/cli#3618, and GitLab's npm registry documentation. Clarify the configuration model for separate pull and push endpoints and how scope, repository URLs, and tokens are associated. Done means the agreed design addresses both mismatch prevention and GitLab's distinct endpoints.