install: Don't omit any deps of dev deps if --only=dev

[jviotti]

At the moment, npm will NOT install a dependency that is both a
production and a development dependency in the same tree if
--only=dev.

Consider the following scenario:

• package1 has prod-dependency in dependencies
• package1 has dev-dependency in devDependencies
• prod-dependency has sub-dependency in dependencies
• dev-dependency has sub-dependency in dependencies

So both prod-dependency and dev-dependency directly depend on
sub-dependency. Since sub-dependency is required by at least one
production dependency, then npm won't consider it as "only a dev
dependency", and therefore running npm install --only=dev will result
in the following tree:

package1/
    node_modules/
        dev-dependency

Notice that sub-dependency has ben completely omitted from the tree,
even though dev-dependency clearly requires it, and therefore it will
not work.

This commit makes --only=dev always install required dependencies of
dev dependencies, so you never end up with a broken tree.

For a more real-world reproducible example, try to run npm install --only=dev in
https://github.com/resin-io/etcher/tree/a338c6e60a10aad00008febfe92e2556dcf586c6.
The resulting tree will be completely broken, but we would not have
identified this if several install scripts wouldn't fail as a result.

Signed-off-by: Juan Cruz Viotti [email protected]

[jviotti]

Ping @iarna @isaacs

[zkat]

I'd like a review from @iarna on this one.

[jviotti]

Re-ping @iarna :)

[nazrhom]

@iarna @zkat any progress on this?