Remove most pnpm hoisting, fix phantom deps (#24096)

We've long had pnpm's public hoisting disabled, but it also privately
hoists everything into `node_modules/.pnpm/node_modules/` for
compatibility with packages that have undeclared dependencies. Let's
disable most of that private hoisting and see what turns up.

Changes of note:

* We still hoist a bunch of eslint plugins (and one prettier plugin) as
  untangling that mess seems like enough work to put off for later.
* Only a few upstream packages have bugs that need working around:
  * `@mdx-js/loader`: mdx-js/mdx#2019
  * `@automattic/components`: Missing dep on `@wordpress/base-styles`.
	And the next version will probably be unusable for us due to added
	`i18n-calypso`.
  * `@automattic/popup-monitor`: Missing dep on `events`.
  * markdown-it`: Missing dep on `punycode`.
    markdown-it/markdown-it#230
  * `@samverschueren/stream-to-observable`: Outdated dep on `any-observable`.
    SamVerschueren/stream-to-observable#9
    Hacking around that should also fix p1649254510834369-slack-CBG1CP4EN.
  * `git-node-fs`: Missing peer dep on `js-git`.
    creationix/git-node-fs#8
* `fetch-mock`'s peer dep on `node-fetch` is optional, but only because
  they also allow running in-browser. It's required for node.
* Added `webpack-cli` alongside `webpack` everywhere to make sure
  p1650571211251179-slack-CBG1CP4EN is fixed. Dropped Webpack entirely
  from Boost instead though, they don't use it.
* Had our webpack-config package point to its own copy of
  `@babel/runtime` instead of making that a peer dep.
* Jetpack's extensions tests use a ton of `@wordpress/` packages that
  weren't being directly depended on.

Committed via a GitHub action: https://github.com/Automattic/jetpack/actions/runs/2234009376

Author: anomiex

jetpack_vendor/automattic/jetpack-assets/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.17.12-alpha] - unreleased
+
+This is an alpha version! The changes listed here are not final.
+
+### Added
+- Add missing JavaScript dependencies, and fix a test.
+
 ## [1.17.11] - 2022-04-26
 ### Changed
 - Updated package dependencies.
@@ -222,6 +229,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Statically access asset tools
 
+[1.17.12-alpha]: https://github.com/Automattic/jetpack-assets/compare/v1.17.11...v1.17.12-alpha
 [1.17.11]: https://github.com/Automattic/jetpack-assets/compare/v1.17.10...v1.17.11
 [1.17.10]: https://github.com/Automattic/jetpack-assets/compare/v1.17.9...v1.17.10
 [1.17.9]: https://github.com/Automattic/jetpack-assets/compare/v1.17.8...v1.17.9

jetpack_vendor/automattic/jetpack-identity-crisis/CHANGELOG.md

@@ -9,6 +9,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 This is an alpha version! The changes listed here are not final.
 
+### Added
+- Add missing JavaScript dependencies.
+
 ### Deprecated
 - Moved the options class into Connection.
 

jetpack_vendor/automattic/jetpack-my-jetpack/CHANGELOG.md

@@ -9,6 +9,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 This is an alpha version! The changes listed here are not final.
 
+### Added
+- Add missing JavaScript dependencies.
+
 ### Changed
 - My Jetpack: remove duplicated site suffix stored on rawUrl. Use siteSuffix instead.