feat: only return false on 404 in hasNpmPackage (#96)

Currently, if the registry returns anything that is not a 200 status
code this function returns `false`. In the case where we are trying to
check whether the package associated to a friendly name and the registry
returns for example a 503 this will result in fetching and installing
the wrong package.

i.e. Doing `heroku plugins:install api`
- Attempt to see if [`@heroku-cli/plugin-api`](https://www.npmjs.com/package/@heroku-cli/plugin-api) exists
- NPM returns 503
- Install [`api`](https://www.npmjs.com/package/api)!!

In this case this is fairly harmless as that particularly library
doesn't do much, however, it is annoying and could be used maliciously!

package.json

@@ -37,6 +37,7 @@
     "fancy-test": "^1.4.1",
     "globby": "^9.1.0",
     "mocha": "^6.0.2",
+    "nock": "^10.0.0",
     "ts-node": "^8.0.3",
     "typescript": "3.8.2"
   },

src/plugins.ts

@@ -234,7 +234,12 @@ export default class Plugins {
       return true
     } catch (error) {
       this.debug(error)
-      return false
+
+      if (error.statusCode === 404) {
+        return false
+      }
+
+      throw error
     }
   }
 

test/commands/plugins/index.test.ts

@@ -42,6 +42,17 @@ describe('command', () => {
   .command(['plugins'], {reset: true})
   .do(output => expect(output.stdout).to.equal('no plugins installed\n'))
   .it('installs and uninstalls jdxcode/oclif-debug')
+
+  test
+  .nock('https://registry.npmjs.org', api => api
+  .get('/-/package/@heroku-cli%2fplugin-stubbed/dist-tags')
+  .reply(503, ''))
+  .command(['plugins:install', 'stubbed'], {reset: true})
+  .catch(/HTTP Error 503/)
+  .stdout()
+  .command(['plugins'], {reset: true})
+  .do(output => expect(output.stdout).to.equal('no plugins installed\n'))
+  .it('does not install if unsure if scoped package does not exist')
   // test
   // .command(['plugins:install', 'heroku-debug@beta'], {reset: true})
   // .stdout()