enable npm9 - #246

data gathering via

• https://github.com/CycloneDX/cyclonedx-node-npm/actions/runs/3306098429
  • ❌ failed due to node14/npm6 is unable to upgrade to npm9 straight away. maybe i need to upgrade to npm8 first?
• https://github.com/CycloneDX/cyclonedx-node-npm/actions/runs/3306123198
  • ❌ local transitive dependencies seam to have an issue
  • caused [BUG] local transitive dependencies cannot be installed with --install-links=true npm/cli#5733
• https://github.com/CycloneDX/cyclonedx-node-npm/actions/runs/3306980869
  • ❌ this matrix is incomplete
  • this matrix had everything passing
  • results: https://github.com/CycloneDX/cyclonedx-node-npm/suites/8915662790/artifacts/408523458
• https://github.com/CycloneDX/cyclonedx-node-npm/actions/runs/3356467133
  • this matrix is complete again
  • ❌ matrix had issues: npm ls failed with npm9
  • see [BUG] local transitive dependencies cannot be installed with --install-links=true npm/cli#5733 (comment)
• https://github.com/CycloneDX/cyclonedx-node-npm/actions/runs/3371012255
  • added .npmrc file to mitigate the [BUG] local transitive dependencies cannot be installed with --install-links=true npm/cli#5733 (comment)
  • looks good to me -> will use this for demos

notable changes in the npm-ls results from latest npm8 to npm9:

• demo bundled-dependencies is identical
• demo dev-dependencies is identical
• demo local-dependencies is identical
• demo local-workspaces changed:
  • property private is now in the result set - as it was in the package.json already
  • property description is now in the result set - as it was in the package.json already
  • property repository is now in the result set - as it was in the package.json already
• demo juice-shop is identical

reviewed the outcome of the SBPM generation processes based on the demos -- looks good to me.