fix: match npm login credential URL scoping

[ponces]

Summary

• Match npm login credential URL scoping when syncing basic and bearer credentials to .npmrc.
• Resolve registry URLs to their directory: a trailing slash preserves the final path segment; without one, credentials use the parent path.
• Preserve non-default ports and exclude query strings and fragments.
• Add regression tests and document scoping behavior, including that existing entries under other scopes are not removed.
• Update the root package-lock.json to lockfile version 3 with supplemental package metadata to avoid npm old-lockfile warnings.

Validation

• Passed: all 64 repository-credential tests (dotnet test tests/tests.csproj --configuration Release --filter "FullyQualifiedName~RepositoryCredentials").
• Passed: git diff --check.
• The pre-commit test suite failed: 50 failed, 785 passed, 2 skipped. Failures included Invalid repository type "Portal", expected one of: CIFS, NPM. in tests.Specs.New.
• The pre-commit hook was bypassed with the user’s approval. The broader test failures have not been investigated or established as pre-existing.
• Restore/build also reported dependency vulnerability warnings.
• The package-lock-only commit skipped tests automatically because no files in cmf-cli, core, or tests changed.

[github-actions]

.NET Test Results

View full test report

[github-actions]

Package	Line Rate	Branch Rate	Health
cmf	48%	48%	➖
core	76%	59%	✔
Summary	59% (6417 / 10808)	54% (3346 / 6248)	➖