Add support for package.json

[wagoodman]

In order to reduce the number of false positives when scanning images while also keeping the value of grype-vscode [directory] scans, it would be useful when scanning directories to key off of index-like files (e.g. package-lock.json) and installation metadata (e.g. package.json within node_module sub-directories) when scanning images for the javascript cataloger.

AC

• Dependencies described within yarn.lock and package-lock.json files are not shown during image scans (but are shown during directory scans).
• The package described in package.json is listed in the SBOM for both image and directory scans.
• NO dependencies listed in the package.json should be present in the SBOM.

Steps to Test

• When scanning a directory:
  • ensure there are examples of a package.json, yarn.lock, package-lock.json files in the directory being scanned.
  • ensure the scan finds all javascript example packages.
• When scanning an image:
  • ensure there are examples of a package.json, yarn.lock, package-lock.json files in the image being scanned.
  • ensure the scan finds all javascript package examples EXCEPT any package-lock.json and yarn.lock references.

Notes for Developer
Should mirror the gemspec cataloger additions made in #203

Today we capture npm packages from discovered package-lock.json and yarn.lock files (which includes top-level dependencies and their dependencies). We should additionally use package.json to discover top-level dependencies, tracking only the package the package.json represents and ignoring any listed dependencies.