WIP: Add javascript dep tree parser

[noqcks]

implements the same functionality desired by #2020

This PR implements a new cataloger called javascript-cataloger that collects full dependency trees and packages with for javascript ecosystem pkg managers -- [pnpm, yarn, npm]

This allows one to see the relationships between packages such as with the dependencies field in CycloneDX https://cyclonedx.org/docs/1.5/json/#dependencies

// NewJavascriptCataloger returns a new JavaScript cataloger object based on detection
// of npm based packages and lock files to provide a complete dependency graph of the
// packages.
func NewJavascriptCataloger() *generic.GroupedCataloger {
	return generic.NewGroupedCataloger("javascript-cataloger").
		WithParserByGlobColocation(parseJavascript, "**/yarn.lock", []string{"**/package.json", "**/yarn.lock"}).
		WithParserByGlobColocation(parseJavascript, "**/package-lock.json", []string{"**/package.json", "**/package-lock.json"}).
		WithParserByGlobColocation(parseJavascript, "**/pnpm-lock.yaml", []string{"**/package.json", "**/pnpm-lock.yaml"})
}

EDIT: just making some final tests pass before this can go for review.