github.com/noqcks/syft@v0.0.0-20230920222752-a9e2c4e288e5/syft/pkg/cataloger/javascript/test-fixtures/pkg-json-and-pnpm-lock (about) package.json pnpm-lock.yaml