Per-package `isTfaRequired(spec, opts)` about cli

[darcyclarke]

👋🏻 Hey @evocateur! I apologize this has taken so long to get to (I'm just getting to this now as I'm sifting through the backlog). I don't think we would have ever been open to exposing whether 2FA is required for packages as it would have provided a way to enumerate packages that may be more susceptible to attack/compromise.

That said, 2FA enforcement in general is being pushed through by our registry counterparts (ref. https://github.blog/2021-12-07-enrolling-npm-publishers-enhanced-login-verification-two-factor-authentication-enforcement/) - so this kind of information would sort of be redundant if everyone is going to be required to use 2FA to publish moving forward. Obviously, automation tokens will still be able to circumvent this to some extent but the way in which you'll have to login, to generate those tokens, will likely change to enforce 2FA as a best practice.

Let me know if there's any follow up discussion/thoughts you have on this but I'm going to close this issue for now.

Future feedback/discussions/ideas about the registry/website APIs can be opened here: https://github.com/npm/feedback/