fix(nodejs): parse workspaces as objects for package-lock.json files

[DmitriyLewen]

Description

This PR fixes npm workspace parsing to properly handle workspace configurations defined as objects rather than just string arrays. The npm workspaces field supports two formats:

• String array: "workspaces": ["packages/", "plugins/"]
• Object format: "workspaces": {"packages": ["packages/", "plugins/"]}

Changes Made

• Updated npm lock parser: Changed Workspaces field type from []string to any in the Package struct to accommodate both formats
• Exported ParseWorkspaces function: Made the workspace parsing function public so it can be reused across npm-related parsers
• Enhanced workspace parsing logic: The ParseWorkspaces function now properly extracts workspace paths from both string arrays and object configurations
• Added comprehensive test coverage: Included test data and test cases for workspace-as-object format

The fix ensures that npm lock files with workspace configurations using the object format (with packages key) are parsed correctly, preventing potential issues in dependency analysis.

Example

before:

➜  trivy -d fs /Users/dmitriy/work/tmp/6129/package-lock.json -f json --list-all-pkgs | grep '"ID"' | wc -l
...
2025-09-24T12:57:37+06:00       DEBUG   Walk error      file_path="package-lock.json" err="parse error: failed to parse package-lock.json: decode error: json: cannot unmarshal JSON object into Go []string within \"/packages/node_modules~1@bpmn-io~1cm-theme/workspaces\""
...
       0

after:

➜ ./trivy -q fs /Users/dmitriy/work/tmp/6129/package-lock.json -f json --list-all-pkgs | grep '"ID"' | wc -l
      23

Related issues

• Close bug(npm): Trivy returns error if packages[].workspaces is object for package-lock.json files #9517

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).