Wr/esm

[WillieRuemmele]

What does this PR do?

ESM

What issues does this PR fix or reference?

[git2gus]

This issue has been linked to a new work item: W-14374934

[mshanemc]

only need 1

[mshanemc]

only one

[mdonnalley]

related to oclif.lock - the postpack and clean:lib scripts should remove the oclif.lock too... Probably should add that to our migrate command

[mshanemc]

the next 4 changes looks like accidentally added spaces

[mshanemc]

Were these a TODO, do the tests not work, has the logic changed, or do these need to be removed?

[mshanemc]

QA notes:

[made a commit with the dev-scripts bump to reduce devDeps and bumped sfdx-core]

./bin/dev.js plugins trust verify -n @salesforce/plugin-org
✅ shows that it is signed

./bin/dev.js plugins trust verify -n shane-sfdx-plugins
✅ shows not signed

[link into sf]
✅ installs
📓 note the double ESM warning
📓 also note that we're pointing the "open an issue about the warnings" at ourselves, too. 😄

➜  plugin-trust git:(wr/esm) sf plugins install @salesforce/plugin-org
 ›   Warning: @salesforce/plugin-trust is a linked ESM module and cannot be auto-transpiled. Existing compiled source will be used instead.
 ›   Warning: @salesforce/plugin-trust is a linked ESM module and cannot be auto-transpiled. Existing compiled source will be used instead.
Polling for new version(s) to become available on npm... done
Successfully validated digital signature for @salesforce/plugin-org.
Finished digital signature check.

sf plugins install shane-sfdx-plugins
✅ prompts for verification
warnings and errors still return fine.

add plugin to allowList, reinstall
✅ The plugin [shane-sfdx-plugins] is not digitally signed but it is allow-listed.