add info to SBOM results: which version of `npm-ls` was used in the process

[jkowalleck]

Is your feature request related to a problem? Please describe.

Internally, npm-ls is used to gather some information, the initial vectors.
see https://github.com/CycloneDX/cyclonedx-node-npm/blob/main/docs/how.md

Current SBOM result contains the tool that was used to gather all data.
But it does not include any information about the npm that was used to gather the initial vectors.
Therefore, it is not entirely clear, HOW a SBOM was created - in terms of reproducibility.

Describe the solution you'd like

add npm with the following version to bom.metadata.tools

• name: "npm"
• vendor: undefined
• version: the version that was detected, unmodified
• hashes: empty
• external references: empty

Describe alternatives you've considered

none

Additional context

npm --version returns a version string