fix: use npm instead of http

[maggiben]

What does this PR do?

Replaces http commands in favor of npm commands

What issues does this PR fix or reference?

@W-9642544@

[mshanemc]

Nice work getting all this cleaned up. Plugin-trust is super critical because it'll completely block plugin instalation if it's not working OK.

I'd like to see a NUT for this that

1. installs any known, good signed plugin (ex: plugin-user)
2. verifies it installs without the error message
3. puts an unsigned plugin on the allowlist
4. installs some known good unsigned plugin (see list https://github.com/mshanemc/awesome-sfdx-plugins. I'd suggest Jochen's jayree plugin)
5. installs some unsigned plugin not on the allow list to verify the warning is happening

I'm not sure if there's a good NUT way to verify that this change solves private npm registry, but the NUT I'm describing would verify that the normal public repository functionality isn't impacted by these changes.

[maggiben]

Nice work getting all this cleaned up. Plugin-trust is super critical because it'll completely block plugin instalation if it's not working OK.

I'd like to see a NUT for this that

1. installs any known, good signed plugin (ex: plugin-user)
2. verifies it installs without the error message
3. puts an unsigned plugin on the allowlist
4. installs some known good unsigned plugin (see list https://github.com/mshanemc/awesome-sfdx-plugins. I'd suggest Jochen's jayree plugin)
5. installs some unsigned plugin not on the allow list to verify the warning is happening

I'm not sure if there's a good NUT way to verify that this change solves private npm registry, but the NUT I'm describing would verify that the normal public repository functionality isn't impacted by these changes.

Hi @mshanemc I added the NUTs you suggested, luckily sfdx-trust and plugin-trust don't interfere with each other. because at this point (in the test suite) we're going to have both installed at the same time.
One of the things that Im concerned about it's not being able to test the prompt for unsigned plugins, as we discussed in the thread with @mdonnalley optional answers parameter to the execCmd function only works on Linux

[mshanemc]

QA: can verify existing plugins are signed
published a private plugin at @salesforce/private-plugin-user which can be found if I'm auth'd on npm (but verifies as not-signed) and 404's when I logout of npm