[BUG] hashes on wrong element

[jkowalleck]

NPM's integrity hash is for the resolved file, not the component in general.
see

cyclonedx-node-npm/demo/package-integrity/project/package-lock.json

Lines 17 to 18 in 2f9b4d2

	"resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.0.1.tgz",
	"integrity": "sha1-aSbRsZT7xze47tUTdW3i/Np+pAg=",

solution: to not put the hash on the component,
but on the externalReference that is build from resolved.