fix: honor COREPACK_NPM_REGISTRY for tarballs hosted elsewhere

[Yash121l]

Fixes #792

When COREPACK_NPM_REGISTRY points at a registry whose metadata advertises dist.tarball on a different host, Corepack downloads the package manager from that host instead of the configured registry. Mirrors and proxy repositories do this when they serve tarballs from a CDN or pass the upstream dist block through unchanged.

installVersion only rewrites the tarball URL when it starts with https://registry.npmjs.org:

url = url.replace(
  npmRegistryUtils.DEFAULT_NPM_REGISTRY_URL,
  () => process.env.COREPACK_NPM_REGISTRY,
);

Any other host falls through untouched. The download then escapes the configured registry, which fails outright when that registry is the only reachable one, and httpUtils.fetch only attaches COREPACK_NPM_TOKEN when the request origin matches COREPACK_NPM_REGISTRY, so a private registry answers 401. The issue reads line 249 as rewriting the URL back to the default registry. The arguments go the other way and that line is harmless; the rewrite is just too narrow.

fetchTarballURLAndSignature now resolves the tarball against the registry the metadata came from. npm tarball URLs use the /<package>/-/<file> layout, so the package path is taken from the advertised URL and appended to the configured registry, which keeps any path prefix the registry is mounted under (for example https://nexus.example.com/repository/npm-group). A URL that does not use that layout is left alone, so the existing replacement in installVersion still covers it. The trailing-slash normalization from fetchAsJson is shared now, so a trailing slash in COREPACK_NPM_REGISTRY no longer produces a double slash in the tarball URL either.

tests/_registryServer.mjs can advertise the tarball on a host other than the registry it serves, via TEST_TARBALL_HOST. The new test in tests/main.test.ts uses it with AUTH_TYPE=COREPACK_NPM_TOKEN. Before the change it fails with Unexpected request to https://cdn.example.org/pnpm/-/pnpm-1.9998.9999.tgz from the mock server's request guard; after it passes. NOCK_ENV=replay yarn test is green (172 passed, 1 expected fail) with tests/nocks.db untouched, and yarn lint and yarn typecheck pass.