chore(deps): bump import-in-the-middle from 1.3.5 to 1.4.2 (#3569)

Also:
- add license text acorn-import-assertions for our NOTICE generation
  (the package doesn't publish it itself)
- Improve ESM docs for Node v20 and the possible error that can be hit
  there now that [email protected] is being used.
- Do some surgery on the package-lock file to get acorn@8 at the
  *top-level* -- used by a non-dev dep import-in-the-middle -- rather
  than acorn@7 at the top (used by a couple dev deps). Unfortunately
  this meant updating some unrelated deps: pug, dependency-check.

Co-authored-by: Trent Mick <[email protected]>

Author: dependabot[bot]

dev-utils/gen-notice.sh

@@ -90,6 +90,7 @@ npm ls --omit=dev --all --parseable \
         // We handle getting the license text for a few specific deps that
         // do not include one in their install.
         const licFileFromPkgName = {
+            "acorn-import-assertions": "license.MIT.txt",
             "async-value": "license.MIT.txt",
             "async-value-promise": "license.MIT.txt",
             "breadth-filter": "license.MIT.txt",

docs/esm.asciidoc

@@ -70,7 +70,10 @@ As well, the APM agent must also be separately *started* -- for example via `--r
 
 Automatic instrumentation of ES modules is based on the experimental Node.js Loaders API. ESM support in the Elastic APM Node.js agent will remain *experimental* while the Loaders API is experimental.
 
-ESM auto-instrumentation is only supported for Node.js versions that match *`^12.20.0 || ^14.13.1 || ^16.0.0 || ^18.1.0 <20`*. Notably, in the current APM agent version, this _excludes Node.js v20_ because of changes in the Loaders API. The behavior when using `node --experimental-loader=elastic-apm-node/loader.mjs` with earlier Node.js versions is undefined and unsupported.
+ESM auto-instrumentation is only supported for Node.js versions that match *`^12.20.0 || ^14.13.1 || ^16.0.0 || ^18.1.0 <20`*.
+The behavior when using `node --experimental-loader=elastic-apm-node/loader.mjs` with earlier Node.js versions is undefined and unsupported.
+
+Notably, ESM auto-instrumentation is *not* supported with Node.js v20 because of changes in the Loaders API. Using the loader with Node.js v20 can result in crashes in `import ...` statements that attempt named imports from some CommonJS modules. The error message will be of the form `SyntaxError: The requested module '<module name>' does not provide an export named '<export name>'`. (You can track https://github.com/DataDog/import-in-the-middle/issues/29[this issue] for progress.)
 
 
 [float]