Non-deterministic install

I discovered a case where `pnpm install` doesn't behave deterministically — when being run again and again, a package (`promise-inflight`) is sometimes added and sometimes removed, resulting in changes in `pnpm-lock.yaml`.



I'm linking [a repository](https://github.com/JanJakes/pnpm-nondeterministic-install) with the issue reproduction. Note that there are many missing peer deps as I was trying to cut down the dependencies and still reproduce the issue.



### pnpm version:

7.6.0



### Code to reproduce the issue:

https://github.com/JanJakes/pnpm-nondeterministic-install



### Expected behavior:

No matter how many times I run `pnpm install` consecutively, there should be no changes in `pnpm-lock.yaml` and `node_modules`.



### Actual behavior:

When `pnpm install` is being run repeatedly, a package keeps being randomly added and removed.



### Additional information:

All details are in the readme of the issue reproduction: https://github.com/JanJakes/pnpm-nondeterministic-install

[
  {
    "category": "security",
    "rule": "issue.security_keyword",
    "source": "issue_body",
    "excerpt": "gain, a package (`promise-inflight`) is sometimes added and sometimes removed, resulting in changes in `pnpm-lock.yaml`.\r\n\r\nI'm linking [a repository](https://github.com/JanJake"
  }
]