Add a Team level Audit Log Entry when NPM publish/unpublish

[hardillb]

Description

This is to allow the npm registry to log team level audit log entries when packages are published/unpublished from the registry

npm registry has callbacks for pub/unpub

Challenges:

• Needs new endpoint in forge/routes/logging/index.js for team level audit events
• This is a 3rd party posting on behalf of a team (owner/member). Would need a trusted auth token.
• Can't post as the user as it doesn't have access to the users token at the point in the npm auth plugin
• We could "attach" the users auth token in the auth callback as an extra "group" but that but feels ugly.
• Or we could keep a lookup table of users -> tokens in memory of the auth plugin. Better but still eww

Epic/Story

#5087

Have you provided an initial effort estimate for this issue?

I have provided an initial effort estimate

[hardillb]

OK, we can only handle publish events

This is because an unpublish event triggers both the publish and the unpublish auth callbacks multiple times with no way to know which event is actually the single unpublish envent.

[hardillb]

And we don't get the version number in the publish event, we do get to know who did it and the name, but that is it