[RRFC] Support multiple project npmrc file

Motivation ("The Why")

At my workplace npm projects have dynamic project specific configuration - such as registry and authentication.
Previous internal build tools set this configuration in environment NPM_CONFIG_ variables before executing npm, but we want to move to setting this configuration in a npmrc file so ide's and other tools can read them.

However we want to separate this dynamic configuration from static configuration (like setting legacy-peer-deps) so static config can be checked into source control while dynamic config can be excluded. So we want two project specific npmrc files.

Example

There are many ways to implement this idea, a new npmrc location, a .npmrc.d directory of files, but I propose a new npm configuration extends=path/to/file (naming up for discussion) that adds an additional additional npmrc file.

# project .npmrc. Checked into source control.

# project settings
legacy-peer-deps=true

extends=.private-project-npmrc

# .private-project-npmrc. Ignored in source control.

registry=https://private.registry
//private.registry/:_auth=...

Ideally npm config would be extended to support arbitrary file paths, either under the —location arg or another.

How

Current Behaviour

Currently there are project, user, global, and built-in npm configurations. Each location has one file. When projects use different registries or authentication there is contention over changes to the project npmrc because some values should be checked into source control while others should not while popular source control systems like git operate on files.

Desired Behaviour

Npm has at-least two project specific npmrc file so one can be checked in while the other is not.

References

• n/a

Start by reviewing npm's project, user, global, and built-in configuration behavior, including the --location argument described in the issue. Compare the proposed extends setting with the alternative npmrc location or directory approaches. Done means npm supports separate project-specific configuration files so static settings can be tracked independently from dynamic registry and authentication settings.