deps: replace chalk with built-in styleText

[james-pre]

TL;DR: get rid of two dependencies and color dependency injection

This PR replaces the chalk dependency with the built-in styleText function provided by node:util. This is already support in all of the Node.js versions npm supports. There is no longer a reason to include a bundled runtime dependency when the platform can do the same job.

The biggest benefit is that we get rid of dependency injection for colors. Before 3 different chalk instances (npm.chalk, npm.logChalk, npm.noColorChalk) were passed to every single command so that the colorization could happen in one place. Now, call sites can use a tiny color utility that is configured by display.js. This also means supports-color is no longer needed so that was removed as well.

npm-audit-report currently uses this dependency injection, which is being addressed in npm/npm-audit-report#162. That PR's changes have been included in this one pending a merge and release, when we can actually update the dependency.

There are a couple of small changes to how rendering is handled:

1. chalk emitted the style escape codes on every line of a multi-line string while styleText emits the codes one. This has no effect on the on the rendered output.
2. chalk automatically handled nested colors, styleText doesn't so we now account for this when highlighting matches in the package name during npm search (the only place styles are nested)

In case it matters this PR results in an 8.2 KB smaller tarball and 22.7 KB smaller install size. This is only a ~0.3% change though.

[james-pre]

One of the patch tests is failing for 24.15.0 due to a race condition during cleanup. This failure isn't related to the PR.

@manzoorwanijk you've done most of the work for npm patch maybe you could take a look:
https://github.com/npm/cli/actions/runs/30023743631/job/89262782728?pr=9793#step:8:9938

[manzoorwanijk]

One of the patch tests is failing for 24.15.0 due to a race condition during cleanup. This failure isn't related to the PR.

@manzoorwanijk you've done most of the work for npm patch maybe you could take a look

Thank you for the ping

Yes, it's unrelated to this PR. I dug into it and there are two defects in npm patch update's rebase workdir handling:

1. Since git 2.48 maintenance.autoDetach defaults to true, so git commit detaches git maintenance run --auto and returns while that background process is still writing to .git/objects/pack. The runner is on git 2.54.0, so the rm -rf of the throwaway repo races it and gets ENOTEMPTY.
2. Both workdir cleanup sites await rm(...) unguarded, so that ENOTEMPTY replaced the legitimate EPATCHBASE the test asserts on (and would fail an otherwise-successful update too).

I have created a fix for it - #9798