[RRFC] support different `--before` policy per package prefix/pattern

Motivation ("The Why")

Consider a corporate with a codebase with a high coverage and a mature CI.
Consider that the corporate's policy is to test on latest and greatest and ship latest and greatest to enjoy all security patches published by the community.
Now consider a counter requirement not to use 3rd-party versions that are too young, because they have not spent enough time in the market for their exploits to be noted.

This requires npm i to distinct between packages of the organization, who's new versions should be accepted as soon as they are published, in contrast to 3rd party open-source packages, who's versions should be X days old before it can enter a build (given that no known issues are detected on them).

This requires a further evolution over the npm i --before <date> option
We need npm to be able to distinct between corporate proprietary packages and the rest.

This could be using scopes, however, I meet too many codebases that still use prefixes which are not scopes, so I believe regex or at least prefixes to be a better solution.

It will also be useful to configure the behavior for not finding a version old enough. Some cases it would be preferable to fail, others to warn.

Example

Assuming we go with regex - then:

npm config set stabilityDays 7d
npm config set 'onOnlyTooNew' warn
npm config set '@my-corp/*.stabilityDays' 0
npm config set '@my-corp/*.onOnlyTooNew' info
npm config set package-that-gave-problems-before.stabilityDays 90
npm config set 'package-that-gave-problems-before.onOnlyTooNew' error

How

Current Behaviour

The current behavior does not distinct between packages.
There is a --before <date> switch, and it will reject too new versions - but it will know to let corporate packages to pass, inhibiting quick responses.

Desired Behaviour

Consider the example above - then:

• by default - versions newer than 7 days are ignored.
• packages who's name start with @my-corp/ (actually match the pattern `/@my-corp/.*/) can pass through
• package-that-gave-problems-before only versions 90 days or older

References

• https://github.com/npm/cli/issues/4494

Start by reading the existing npm --before behavior and the referenced npm/cli issue #4494; the payload names no source files or tests. Work out how package prefixes or patterns select different stabilityDays and onOnlyTooNew policies. Done means the proposal covers defaults, per-package overrides, and warn, info, or error behavior for versions that are too new.