rfc: npm audit fix provides overrides

[iarna]

Allow npm audit fix to update overrides for non-semver compatible changes.

• Edit: Not ALL semver incompatible changes. But as an optional kind of advice that says "this is semver incompatible but we assure you it will work anyway".

See RFC for detail.

References

Depends on: #129

[isaacs]

Decided in 2021-04-14 meeting: ratify once overrides RFC is ratified (which is only pending final review)

[isaacs]

I think that the endpoint return data suggested here is entirely appropriate. If we see an overrides in the batch advisory result, we can just apply it to the root package.json. (Or not and just suggest it, or apply if a flag is set, etc. UX tbd.)

Resolving questions and moving to accepted.