feat(nodejs): add v9 pnpm lock file support

[DmitriyLewen]

Description

add v9 pnpm lock file support.

• Dev field used for v9

Related issues

• Close feat(pnpm): add support of Lockfile v9 #6509

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

I have not seen any requests to use Dev field for version 6.0 or earlier lock files.
But if users want, we can add this in another PR.

[knqyf263]

Looks almost good

[knqyf263]

Suggested change

	"golang.org/x/exp/maps"
	"maps"

[DmitriyLewen]

This is weird, but maps package doesn't have Values and Keys functions:
https://pkg.go.dev/maps

[knqyf263]

PURL has vcs_url. I think we should keep this information if it is not registry.npmjs.org.
https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#npm

[DmitriyLewen]

I am not sure if using registry URL in package name is correct.
I suggest keeping depPath in ExternalReferences
and check ExternalReferences in purl for npm:

trivy/pkg/purl/purl.go

Lines 425 to 429 in bbaf595

	func parseNpm(pkgName string) (string, string) {
	// the name must be lowercased
	name := strings.ToLower(pkgName)
	return parsePkgName(name)
	}

e.g.
private.npmjs.org/@babel/[email protected] =>

ID:           "@babel/[email protected]",
Name:         "@babel/runtime",
Version:      "7.18.3",
Relationship: ftypes.RelationshipIndirect,
ExternalReferences: []ftypes.ExternalRef{
	{
		Type: ftypes.RefVCS,
		URL:  "private.npmjs.org/@babel/[email protected]",
	},
},

@knqyf263 wdyt?

[knqyf263]

Yes, I meant to suggest using ExternalReferences. I didn't explain clearly.

[DmitriyLewen]

I update this logic - 2d50522
take a look, when you have time, please