fix(arborist): only replace hostname for resolved URL - #8185

…ls (#8356)

When custom hosted git url are used to install dependencies it's not
installing that dependency when the url is of
`git+ssh://git@customgit.com:a/b/c.git` format instead of
`git+ssh://git@customgit.com/a/b/c.git`.

#### Cause:
` new URL(resolved)` throws an error which is getting caught and in-turn
results in removal of that node.
This behaviour was working as expected before this
#8185 which replaced
`hgi.parseUrl(resoved)` call to `new URL(resolved)`

#### Fix:
keep the `hgi.parseUrl` call to correctly parse the git url as
mentioned/explained in this PR #5758

Fixes: #8331

Starting with npm 11.3.0 (arborist 9.0.2, npm/cli#8185) the install rewrites
lockfile and packument tarball URLs onto the configured registry by copying
only its hostname and port. The timewarp credentials carried in the registry
URL are dropped, every tarball request reaches timewarp unauthenticated, and
the install fails with "unsupported platform". Versions before 11.6.0 fail
earlier with a TLS error because the https scheme is kept as well.

Pass --replace-registry-host=never, the documented spelling of what the
previous commit's "true" value did by falling through to the hostname
string type. npm 12 refuses tarballs from a host other than the registry
unless allow-remote permits it, so pass --allow-remote=all alongside.
Both flags are accepted by every npm 11 release.

Derive the flags from the npm version inside the install tool rather than a
strategy field. This incurs no backwards compatibility concerns as all
applicable builds were failed and, thus, published no strategies.

Starting with npm 11.3.0 (arborist 9.0.2, npm/cli#8185) the install rewrites
lockfile and packument tarball URLs onto the configured registry by copying
only its hostname and port. The timewarp credentials carried in the registry
URL are dropped, every tarball request reaches timewarp unauthenticated, and
the install fails with "unsupported platform". Versions before 11.6.0 fail
earlier with a TLS error because the https scheme is kept as well.

Pass --replace-registry-host=never, the documented approach to falling
through to the hostname string type. npm 12 refuses tarballs from a host
other than the registry unless allow-remote permits it, so pass
--allow-remote=all alongside. Both flags are accepted on npm 11.

Derive the flags from the npm version inside the install tool rather than a
strategy field. This incurs no backwards compatibility concerns as all
applicable builds were failed and, thus, published no strategies.

---------

Co-authored-by: Matthew Suozzo <msuozzo@google.com>