fix: resolve parent for non-registry dep on only mode

[santiagoaguiar]

When a prod dependency A and a dev dependency B both depend on a dependency C that is not installed through a registry (eg. was installed through github), and we are running in production-only mode, the updateJson process fails because the parent dependency package.json file cannot be resolved.

We ran into this issue while moving from yarn to npm. Our project used a mix of registry and github installed dependencies. When attempting to run npm ci --production, the task failed with an enoent ENOENT: no such file or directory error when reaching the updateJson stage.

The PR includes a fix that picks the first parent that is a valid dependency for the mode we are running in.

The test describes the case we ran into.

We tested the fix successfully in our project.

closes: #23