This version has all the known security patches in v3.x,
and is meanwhile the recommended version to use from CommonJS
(NodeJS-style) modules, as opposed to ESM.
Atom's build and CI scripts are all CommonJS as far as I know,
so we should basically stay on node-fetch v2.x.
This fixes the currently broken "Bump dependencies" job in Nightly CI.
Effectively reverts ad1318e3fb,
AKA https://github.com/atom/atom/pull/23506,
albeit with a more up-to-date patch version of node-fetch v2.x.