shrinkwrap should be registry-agnostic when sourcing package tarballs

[othiym23]

Specifically, when _resolved is an HTTP[S] link to a tarball, save the shasum as well as the URL, and ask the cache if it has a package with that shasum before hitting the network. This relies upon the content-addressible tarball cache that's part of the cache rewrite, but it should be easy enough to add once that functionality is available.

[othiym23]

This is absolutely a part of the roadmap for improving shrinkwrap as well as the putative, oft-discussed, never-implemented npm CLI cache rewrite. It should be possible to shrinkwrap a package by tying the lock to the package's contents rather than its URL of origin.