[RRFC] `npm audit fix` should remove optional deps if necessary

Motivation ("The Why")

Sometimes an optional transitive dependency may have a security advisory against it, and there may be no way to fix it.

For example:

$ npm i express-prometheus-middleware@1.2.0

added 69 packages, and audited 136 packages in 3s

7 packages are looking for funding
  run `npm fund` for details

5 vulnerabilities (3 high, 2 critical)

To address all issues, run:
  npm audit fix

Run `npm audit` for details.

$ npm audit fix

up to date, audited 136 packages in 565ms

7 packages are looking for funding
  run `npm fund` for details

5 vulnerabilities (3 high, 2 critical)

To address all issues, run:
  npm audit fix

Run `npm audit` for details.

# oof

# but! check this out!

$ npm i express-prometheus-middleware --omit=optional

added 65 packages, and audited 66 packages in 460ms

7 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

Example

How

Current Behaviour

Desired Behavior

References

• n/a

Start with the npm audit fix command and the optional dependency behavior shown in the issue's express-prometheus-middleware example. Clarify the desired behavior and constraints for removing optional dependencies, then define done as resolving the reported advisories without requiring --omit=optional; no files or tests are named, so implementation entry points still need to be located.