fix: redact json output value by value so a url cannot corrupt it

[lazerg]

What / Why

npm ls --json --long prints nothing and exits 1 when the tree holds a package whose deprecated message contains a url, for example @esbuild-kit/esm-loader@2.6.5 ("Merged into tsx: https://tsx.hirok.io"). Tools that shell out to it, like @cyclonedx/cyclonedx-npm, fail with "failed to parse npm-ls response".

redactValue in lib/utils/display.js redacted the whole serialized document: JSON.parse(redactLog(JSON.stringify(obj))). Compact json has no whitespace, so the url matcher in @npmcli/redact reads from https:// all the way to the next @ (here the _id of a scoped package) and treats everything between as user:password@. What comes back is no longer json, JSON.parse throws inside the flush, and the error is swallowed. Pretty printed output never hit this because the newlines stop the matcher, which is why it only appeared once redaction moved to compact JSON.stringify in 11.15.0.

The document is still serialized the same way, so toJSON and dropped keys behave as before, but redaction now runs over the parsed value one string at a time. Punctuation around a value can never be pulled into a match. Object keys are left alone, which in npm's json output means config names, package names and script names.

Testing

New case in test/lib/utils/display.js: a deprecation message with a url next to a scoped _id stays intact, arrays are walked, a Date still serializes, and a url password is still redacted. It throws the same SyntaxError without the change.

References

Fixes #9873