Remove most pnpm hoisting, fix phantom deps (#24096)

We've long had pnpm's public hoisting disabled, but it also privately
hoists everything into `node_modules/.pnpm/node_modules/` for
compatibility with packages that have undeclared dependencies. Let's
disable most of that private hoisting and see what turns up.

Changes of note:

* We still hoist a bunch of eslint plugins (and one prettier plugin) as
  untangling that mess seems like enough work to put off for later.
* Only a few upstream packages have bugs that need working around:
  * `@mdx-js/loader`: mdx-js/mdx#2019
  * `@automattic/components`: Missing dep on `@wordpress/base-styles`.
	And the next version will probably be unusable for us due to added
	`i18n-calypso`.
  * `@automattic/popup-monitor`: Missing dep on `events`.
  * markdown-it`: Missing dep on `punycode`.
    markdown-it/markdown-it#230
  * `@samverschueren/stream-to-observable`: Outdated dep on `any-observable`.
    SamVerschueren/stream-to-observable#9
    Hacking around that should also fix p1649254510834369-slack-CBG1CP4EN.
  * `git-node-fs`: Missing peer dep on `js-git`.
    creationix/git-node-fs#8
* `fetch-mock`'s peer dep on `node-fetch` is optional, but only because
  they also allow running in-browser. It's required for node.
* Added `webpack-cli` alongside `webpack` everywhere to make sure
  p1650571211251179-slack-CBG1CP4EN is fixed. Dropped Webpack entirely
  from Boost instead though, they don't use it.
* Had our webpack-config package point to its own copy of
  `@babel/runtime` instead of making that a peer dep.
* Jetpack's extensions tests use a ton of `@wordpress/` packages that
  weren't being directly depended on.

Author: anomiex

.npmrc

@@ -4,5 +4,21 @@ strict-peer-dependencies = true
 # Force node version
 engine-strict = true
 
-# Default, minus eslint.
-public-hoist-pattern=['*types*', '@prettier/plugin-*', '*prettier-plugin-*']
+# No hoisting by default.
+hoist-pattern=[]
+public-hoist-pattern=[]
+
+# Hoist eslint crap. Too many problems there to figure out right now.
+# Probably we need to move more of the different eslint configs into tools/js-tools/eslintrc/.
+hoist-pattern[]='@babel/eslint-parser'
+hoist-pattern[]='@typescript-eslint/parser'
+hoist-pattern[]='@typescript-eslint/eslint-plugin'
+hoist-pattern[]='@wordpress/eslint-plugin'
+hoist-pattern[]='eslint-config-prettier'
+hoist-pattern[]='eslint-import-resolver-node'
+hoist-pattern[]='eslint-plugin-es5'
+hoist-pattern[]='eslint-plugin-playwright'
+hoist-pattern[]='eslint-plugin-react'
+
+# Hoist prettier crap too.
+hoist-pattern[]='prettier-plugin-svelte'

.pnpmfile.cjs

@@ -20,6 +20,24 @@ function fixDeps( pkg ) {
 			pkg.dependencies[ '@wordpress/components' ] = '^19.2.0';
 		}
 	}
+	if ( pkg.name === '@automattic/components' ) {
+		// 1.0.0-alpha.3 published 2020-11-11. Not that we want alpha.4, they added an i18n-calypso dep (ugh).
+		if ( ! pkg.dependencies[ '@wordpress/base-styles' ] ) {
+			// Depends on this but doesn't specify it.
+			pkg.dependencies[ '@wordpress/base-styles' ] = '^4.0.4';
+		}
+	}
+
+	// Depends on events but doesn't declare it.
+	if ( pkg.name === '@automattic/popup-monitor' && ! pkg.dependencies.events ) {
+		pkg.dependencies.events = '^3.3.0';
+	}
+
+	// Depends on punycode but doesn't declare it.
+	// https://github.com/markdown-it/markdown-it/issues/230
+	if ( pkg.name === 'markdown-it' && ! pkg.dependencies.punycode ) {
+		pkg.dependencies.punycode = '^2.1.1';
+	}
 
 	// Even though Storybook works with webpack 5, they still have a bunch of deps on webpack4.
 	if ( pkg.name.startsWith( '@storybook/' ) ) {
@@ -37,6 +55,15 @@ function fixDeps( pkg ) {
 		}
 	}
 
+	// Outdated dep.
+	// https://github.com/SamVerschueren/stream-to-observable/pull/9
+	if (
+		pkg.name === '@samverschueren/stream-to-observable' &&
+		pkg.dependencies[ 'any-observable' ] === '^0.3.0'
+	) {
+		pkg.dependencies[ 'any-observable' ] = '^0.5.1';
+	}
+
 	// Project is supposedly not dead, but still isn't being updated.
 	// For our purposes at least it seems to work fine with jest-environment-jsdom 27.
 	// https://github.com/enzymejs/enzyme-matchers/issues/353
@@ -95,6 +122,12 @@ function fixPeerDeps( pkg ) {
 		delete pkg.peerDependencies?.[ 'eslint-plugin-node' ];
 	}
 
+	// Peer-depends on js-git but doesn't declare it.
+	// https://github.com/creationix/git-node-fs/pull/8
+	if ( pkg.name === 'git-node-fs' && ! pkg.peerDependencies?.[ 'js-git' ] ) {
+		pkg.peerDependencies[ 'js-git' ] = '*';
+	}
+
 	// Outdated. Looks like they're going to drop the eslint-config-wpcalypso package entirely with
 	// eslint-plugin-wpcalypso 5.1.0, but they haven't released that yet.
 	if ( pkg.name === 'eslint-config-wpcalypso' ) {