feat: add knownVulnerable semver range option

[isaacs]

This provides the ability of the caller to set a 'knownVulnerable'
SemVer range, so that @npmcli/arborist can attempt to avoid known
vulnerable packages when performing audit fix operations.

[darcyclarke]

✅ LGTM

[isaacs]

Changed the name of the field, since pickManifest doesn't need to know why you're avoiding those versions, only that you are.

Considering adding an avoidStrict: <Boolean> option to tell it to be a little more aggressive about avoiding the versions in that range, even to the point of returning a result outside the provided spec range, so that we can detect if a vulnerability fix is available, and if so, whether it's a semver major update or an allegedly-safe change to the dep range. When avoid strict is set:

• Pick the manifest via the current method.
• If result is not in the avoid range, then return it.
• Else, if the spec is not already ^${result version}, then try to resolve with ^${result version}.
• If result is not in the avoid range, then return it.
• Else, try to resolve with *
• If the result is not in the avoid range, then return it.
• Else, throw "could not resolve" error.

[darcyclarke]

✅ Looks good to go.