[ui] Namespaced and file-specified deps for consul-ui

[philrenaud]

Description

This resolves an ambiguous dependency resolution in consul-ui in the event that a developer attempted to yarn install or npm install from a non-workspace-root directory. This handles it in two ways:

• Namespaces with a @hashicorp/ prefix, reducing the risk of a hypothetical public registry squat situation should local packages ever stop being relative
• Explicitly locally dependency-links packages

Something to note with this is that the packages become a little more bound together than before; for example, it would be more difficult to maintain multiple valid versions of a sub-package here and let consul-ui differentiate between them. We could expand this into submodules some day, but not today.

[dduzgun-security]

Awesome work @philrenaud, thanks a lot for doing that this quickly 🙌
One small comment about consul-ui, should we bump the version to 2.2.1?

[philrenaud]

Note: in order to resolve a non-standard license in a dependency-of-dependency-of-dependency, in 36fef17e6cdc9dbb088de1bbad9bc4ed44eee6ee I've done two things:

• pinned tailwindcss to a specific version that no longer imports the dependency chain that would ultimately include a non-standard license
• made a config file at .yarnrc to specify that package resolution should come from registry.npmjs.org rather than registry.yarnpkg.com. This was a precedent set in Upgrade Consul UI to Node 18 (#19252) #19362 (see yarn lock for all the domain changes) likely due to an environment variable for the upgrader at the time. This change enshrines it.

[dduzgun-security]

LGTM! Huge thanks for fixing this and for all the details you have provided for the resolution, it's awesome 👍
We can merge once tests are passing