[BUG] npmInstallCommand is incorrect

[isaacs]

The default npmInstallCommand on https://github.com/npm/pacote/blob/latest/lib/fetcher.js#L98-L105 was copied from pacote 9, and may have made sense for npm v6. However, it's incorrect for npm v7 (and arguably was incorrect in npm v6 as well).

    this.npmInstallCmd = opts.npmInstallCmd || [
      'install',
      '--only=dev', // only install dev, not actually supported on v7, which is a bug
      '--prod', // only install prod, this overrides the --only=dev anyway, so no devs get installed!
      '--ignore-prepublish', // not a config we support in v7, but probably should? Also, maybe not a good idea here!
      '--no-progress',
      '--no-save',
      // should probably add --no-audit, why do the extra work?
    ]

Re: npm/cli#1865