fix: Enforce allow-git/allow-file/allow-directory/allow-remote configs at the arborist resolution layer

[owlstronaut]

Pacote already enforces these settings inside FetcherBase.get, but it only sees what its callers tell it — specifically the _isRoot flag, and it never gets called at all for directory specs, which arborist resolves by creating a Link node directly.

That left two gaps: pacote couldn't gate directory deps because it never saw them, and the _isRoot hint it received was wrong for any transitive that flowed through a synthesized virtualRoot or a hoisted location. Moving the check into arborist closes both: arborist is the only layer that has the real tree context (the actual edge being resolved, with its true from node) and the only layer that sees every spec type before any branching. Pacote's gate stays in place as defense-in-depth for direct pacote consumers, but the authoritative enforcement now lives where the truth lives.

fixes#9347

[nishantms]

Read-through of the arborist allow-* enforcement. Approach (lift the gate above the symlink branch and the manifest cache) is right, and the soft-fail-via-#loadFailures handling for optional transitives is the correct behavior. A few non-blocking nits below.

[github-actions]

⚠️ Backport to release/v11 failed.

This usually means the cherry-pick had conflicts. Please create a manual backport:

git fetch origin release/v11
git checkout -b backport/v11/9348 origin/release/v11
git cherry-pick -x f550eb415de0aff83a5fa297850104f5390a6e30~3..f550eb415de0aff83a5fa297850104f5390a6e30
# resolve any conflicts, then:
git push origin backport/v11/9348

Error details

Command failed: git cherry-pick -x f550eb415de0aff83a5fa297850104f5390a6e30~3..f550eb415de0aff83a5fa297850104f5390a6e30
error: could not apply e0f12f7e5... feat: add allow-git/allow-file/allow-directory/allow-remote configs
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"