enable npm9

[jkowalleck]

fixes #245

• enable CI to gather npm9-based work-data
• have data gathering work with all existing demos -- no exclusions
• have generated SBOM based on latest demo data
• raise compat version of npm to 6-9
• have npm9 support announced - README & package.json

[jkowalleck]

data gathering via

• https://github.com/CycloneDX/cyclonedx-node-npm/actions/runs/3306098429
  • ❌ failed due to node14/npm6 is unable to upgrade to npm9 straight away. maybe i need to upgrade to npm8 first?
• https://github.com/CycloneDX/cyclonedx-node-npm/actions/runs/3306123198
  • ❌ local transitive dependencies seam to have an issue
  • caused [BUG] local transitive dependencies cannot be installed with --install-links=true npm/cli#5733
• https://github.com/CycloneDX/cyclonedx-node-npm/actions/runs/3306980869
  • ❌ this matrix is incomplete
  • this matrix had everything passing
  • results: https://github.com/CycloneDX/cyclonedx-node-npm/suites/8915662790/artifacts/408523458
• https://github.com/CycloneDX/cyclonedx-node-npm/actions/runs/3356467133
  • this matrix is complete again
  • ❌ matrix had issues: npm ls failed with npm9
  • see [BUG] local transitive dependencies cannot be installed with --install-links=true npm/cli#5733 (comment)
• https://github.com/CycloneDX/cyclonedx-node-npm/actions/runs/3371012255
  • added .npmrc file to mitigate the [BUG] local transitive dependencies cannot be installed with --install-links=true npm/cli#5733 (comment)
  • looks good to me -> will use this for demos

[jkowalleck]

notable changes in the npm-ls results from latest npm8 to npm9:

• demo bundled-dependencies is identical
• demo dev-dependencies is identical
• demo local-dependencies is identical
• demo local-workspaces changed:
  • property private is now in the result set - as it was in the package.json already
  • property description is now in the result set - as it was in the package.json already
  • property repository is now in the result set - as it was in the package.json already
• demo juice-shop is identical

---

reviewed the outcome of the SBPM generation processes based on the demos -- looks good to me.