fix(npm): derive direct dependencies from root lock entry

[tgolob]

Summary

• derive npm lockfile v2/v3 direct dependencies from the root packages[""] dependency sections instead of physical node_modules depth
• require a root-level install key so nested workspace/package copies remain transitive
• leave direct_dependency unknown for hidden lockfiles that omit the root package descriptor
• document the inference and add regression coverage

Fixes #74.

Reproduction

With a project that declares only is-odd@3.0.1, npm hoists its transitive is-number@6.0.0 dependency into root node_modules. Before this change, Bumblebee marked both packages as direct because both lockfile keys were top-level. After this change, the scanner reports:

{"name":"is-number","direct_dependency":false}
{"name":"is-odd","direct_dependency":true}

Tests

• go build ./cmd/bumblebee
• go test ./...
• go test -race ./...
• go vet ./...
• gofmt -l .
• ./bumblebee selftest
• replayed the scanner against a lockfile produced by npm 11.19.0