feat: provide config extends feature

[antongolub]

This PR provides config extensions with github-hosted assets:

{
  "extends": "owner/repo/main",
  "packages": {
    "packages/bot-config-utils": {
    }
  }
}

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)

Fixes #2048 🦕
Fixes #1979

[chingor13]

Thanks for this pull request and this general feature seems useful!

However, we're aiming to be conservative with the number of external dependencies we take, and config management hasn't been enough of a pain point that we want to outsource this logic yet.

To me, it seems like we need a way to fetch the remote files (included in this PR) and a deepMerge implementation (~15 LoC, rather than the external dependency).

[chingor13]

This flag is used in test because we've been using nock to fake http requests and it can't handle the built-in fetch :(

[antongolub]

Is it necessary to mock the transport layer? Maybe http.getJson mock would suffice here?

[chingor13]

Perhaps:

• owner/repo@branchOrSha:path/to/file.json
• owner/repo/path/to/file.json@branchOrSha
• owner/repo:path/to/file.json@branchOrSha

Or something similar to https://docs.renovatebot.com/config-presets/#github

[antongolub]

We can combine. I've added support for the renovate-like format and for the last two options.

[antongolub]

~15 LoC, rather than the external dependency

I understand... But once the 15loc deepmerge meets the prod area, it turns into 115loc deepmerge. And another 1115 lines of tests. I know this road; I have walked along it many many times. I'd even suggest using yargs/helpers#applyExtends here, but unfortunately there is no way to override its internal loader.

Dependencies are always a trade-off between complexity, risks and implementation costs. For example, someone's reinventing cosmiconfig in place (ref1, ref2, ref3), while release-please uses yaml@^2.2.2 and js-yaml@^4.0.0 as prod deps as the same time :)

deepmerge itself doesn't answer what to do with plugins: concat or replace?