fix: exempt explicit tarball targets from allow-file

[lazerg]

npm publish ./pkg.tgz and npm pack ./pkg.tgz fail with EALLOWFILE when allow-file is none or root. The tarball named on the command line is the package being packed or published, not a dependency, but the dependency fetch policy was still applied to it when reading its manifest and tarball.

This does for file specs what #9756 did for directory specs: pack, publish and libnpmpack set allowFile: 'all' when the target itself is a local tarball. Dependency fetches are unchanged.

Testing

Added allow-file=none|root cases for a tarball target to the pack, publish and libnpmpack tests. They fail with EALLOWFILE before the change and pass after. The full suite passes locally.

References

Fixes #10144