Publish platform-specific binaries via npm packages

[nwalters512]

In the wake of recent supply-chain attacks, JS package managers have started disabling install scripts by default. Squawk currently relies on one to install platform-specific binaries:

squawk/package.json

Line 19 in 02c90e8

"install": "node js/install.js"

With such package managers, squawk currently fails silently because of the missing binaries (see #1130). This is possible to work around by adding squawk-cli to an allowlist, e.g. via https://pnpm.io/settings#allowbuilds. However, this opens users of the package up to a higher risk if squawk-cli is ever compromised.

Other packages, like esbuild and @sentry/cli, make use of platform-specific optional dependencies to distribute native binaries and avoid install scripts entirely. squawk-cli should strongly consider doing the same.

Here's a concrete example from the @sentry/cli package.json:

{
  "optionalDependencies": {
    "@sentry/cli-darwin": "3.4.2",
    "@sentry/cli-linux-arm": "3.4.2",
    "@sentry/cli-linux-arm64": "3.4.2",
    "@sentry/cli-linux-i686": "3.4.2",
    "@sentry/cli-linux-x64": "3.4.2",
    "@sentry/cli-win32-i686": "3.4.2",
    "@sentry/cli-win32-x64": "3.4.2",
    "@sentry/cli-win32-arm64": "3.4.2"
  }
}

[sbdchd]

Thanks for the report! I think it should be all set now as of #1133

[nwalters512]

@sbdchd awesome, thanks for the incredibly fast turnaround here!