Do not include optional dependencies in the lockfile when ignoreOptionalDependencies is set to true

[zkochan]

Optional dependencies are mostly not very useful. Especially when a project is mainly developed on Windows. Sometimes it makes sense to set optional=false for a project. However, pnpm currently resolves the optional dependencies and adds them to the lockfile even if optional is set to false. As a consequence, pnpm audit will report vulnerabilities about optional dependencies even though they are not installed.

Changing the way the optional setting works might be not a good idea as it is a setting that may be declared globally. Instead, we may add a new option called ignoreOptionalDependencies that would have to be added to the pnpm field of the package.json file.