Simplify hybrid manifest/lockfile cases in NPM ecosystem

[deivid-rodriguez]

Code improvement description

In the updater implementation living at npm_and_yarn/, there's quite a few places that establish a priority of package managers when mixed files are found, like when both Yarn & NPM lockfiles are present. For example, if both NPM and Yarn files are present, we choose Yarn 🤷‍♂️.

We should probably raise in these mixed cases and raise an error during file fetching when they happen. If we also persist the resolved package manager somewhere that the rest of the update components can access, we should be able to fully eliminate this "priority of package managers" from everywhere.

[jeffwidman]

Examples of this in our code:

• Add PNPM support #7081 (comment)
• Add PNPM support #7081 (comment)

Additionally, I expect us to hit more edge cases over time where we actually aren't sure with 100% confidence which package manager the user wants to use... so IMO we should consider dropping all the guessing in favor of switching to having the user explicitly configure in dependabot.yaml which package manager they want us to use, rather than guessing:

• Replace package-ecosystem with specifying both language and package-manager in dependabot.yml #7189

[deivid-rodriguez]

I'm starting to improve this at #7134, by only fetching files for the selected package manager if packageManager is configured in the package.json file.