feat: prefer trusted data, fix external deps edge-cases

[jkowalleck]

the revisit's goal:

• prefer trusted data from the npm-ls. this might lead to changes in the output.
• properly handle external packages edge-cases. this might lead to changes in the output.
• try to simplify the implementation's design
• have consistent tests over all systems

closes #1304

---

• BREAKING Changes
  • SBOM results might have slightly changed
• Fixed
  • External dependency edge-cases are now properly nested
• Changed
  • SBOM result's purl is prefixed with parent-component's one to ensure uniqueness
  • Uses only trusted data from npm-ls internally
    No changes in data quality are expected.

[codacy-production]

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
✅ +3.93%	∅ (target: 80.00%)

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (2e4686b)	4104	3461	84.33%
Head commit (fc975bf)	4224 (+120)	3728 (+267)	88.26% (+3.93%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#1307)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings    Change summary preferences