fix(unpublish): properly apply publishConfig

[wraithgar]

The tests for unpublish were mocked so heavily they weren't actually
asserting anything. In rewriting them several bugs were found.

• write=true was not being consistenly used when fetching packument
  data, it is now.
• The decision on when to load the local package.json file was not
  working at all, that has been fixed. If the cwd contains a
  package.json whose name matches the package you are uninstalling, the
  local package.json will be read and its publishConfig applied to your
  request.
• dead code inside the npm unpublish path was removed. There is no
  need to check if you are unpublishing the last version here, you're
  already unpublishing the entire project.
• publishConfig is now being applied through the config flatten method,
  not a raw object assignment.

[wraithgar]

Closes #4331

[nlf]

this looks great. these tests are leaps and bounds better than the old ones!

[npm-robot]

no statistically significant performance changes detected

timing results

app-large	clean	lock-only	cache-only	cache-only peer-deps	modules-only	no-lock	no-cache	no-modules	no-clean	no-clean audit
npm@8	52.493 ±3.12	27.723 ±0.03	16.063 ±0.07	18.275 ±0.81	2.713 ±0.00	2.718 ±0.02	2.231 ±0.04	10.640 ±0.09	2.198 ±0.02	3.196 ±0.08
#4601	47.375 ±0.17	27.820 ±0.07	16.075 ±0.00	18.705 ±0.82	2.755 ±0.00	2.738 ±0.02	2.218 ±0.01	10.680 ±0.16	2.199 ±0.01	3.299 ±0.18

app-medium	clean	lock-only	cache-only	cache-only peer-deps	modules-only	no-lock	no-cache	no-modules	no-clean	no-clean audit
npm@8	35.475 ±2.48	21.494 ±0.11	11.877 ±0.05	12.829 ±0.02	2.470 ±0.03	2.480 ±0.01	2.194 ±0.03	7.930 ±0.12	2.070 ±0.03	2.849 ±0.02
#4601	34.564 ±1.49	21.632 ±0.20	11.917 ±0.09	13.018 ±0.61	2.438 ±0.01	2.456 ±0.02	2.209 ±0.01	7.923 ±0.13	2.071 ±0.01	2.829 ±0.05

[wraithgar]

Updated to remove a rogue comment.