feat: namespace install-script approval commands under npm install-scripts (#9629)

Add a namespaced `npm install-scripts` command that groups the
install-script approval operations, following npm's existing `npm cache
<cmd>` / `npm token <cmd>` convention:

- `npm install-scripts approve <pkg>... | --all`
- `npm install-scripts deny <pkg>... | --all`
- `npm install-scripts ls` (list packages with unreviewed install
scripts)

The shipped `npm approve-scripts` and `npm deny-scripts` commands keep
working as aliases for `approve` and `deny`, so this is additive and
backwards compatible. The shared `AllowScriptsCmd` base now dispatches
through `runMode(mode, args)`; the standalone commands route through it
via `static verb`. The `--allow-scripts-pending` flag is only honored by
the commands that declare it, so the namespace lists exclusively through
`ls`.

## References

Closes #9545
Follow-up from RFC npm/rfcs#868.