* fix: runtime dependency missing as explicit dependency
Currently, when `@verdaccio/signature` is loaded, in particular the `signature.js` file, the `@verdaccio/config` module is being loaded but it's not an explicit dependency. It's just a dev dependency. This is problematic with e.g. pnpm as package manager which intentionally tries to prevent such "leaking"/"escaping" of dependencies.
* lock file
---------
Co-authored-by: Juan Picado <juanpicado19@gmail.com>
