fix!: stop ignoring NODE_TLS_REJECT_UNAUTHORIZED when strictSSL is not defined

[brunoargolo]

BREAKING CHANGE: the NODE_TLS_REJECT_UNAUTHORIZED environment variable is no longer being ignored if strictSSL is not defined

Currently NODE_TLS_REJECT_UNAUTHORIZED is simply ignored as options.rejectUnauthorized is always set to false when strictSSL is not defined.

Most notably this causes issues for users behind corporate proxies using npm and pnpm when installing a package that uses node-gyp. Example: nodejs/node-gyp#2663

This change only takes into account NODE_TLS_REJECT_UNAUTHORIZED when strictSSL is not passed to fetch.

unit tests were added to ensure strictSSL is still the primary driver.

[wraithgar]

This was brought up before in #257. Given its use in node-gyp it makes sense to revisit though.

Is this a breaking change?

[brunoargolo]

Hey @wraithgar, confirming this is a non-breaking change.
The behaviour is only modified if NODE_TLS_REJECT_UNAUTHORIZED is set AND the fetch function caller has not specified the strictSSL param (undefined or null).
I've included new unit tests to cover scenarios when the env variable is set.