npm transitive alias support

[dterrybd]

There were two things going on here. 1) Aliases to the same package were not properly handled in the map and 2) aliases were only handled at the root project level. If components used aliases in their own package.json files, Detect would not appropriately discover that.

Problem 1 — Lockfile detector: aliases to the same package conflated into one BOM entry

When a project declares multiple aliases to the same underlying package (e.g. "react-is-18": "npm:react-is@18.3.1" and "react-is-19": "npm:react-is@19.2.7"), the lockfile detector reported only one of them in the BOM.

Root cause: NpmDependencyConverter was storing actual package name (react-is) rather than their alias key. Both entries then had NpmDependency.name = "react-is", so when the graph transformer looked
up each declared dependency by name the code returned the same object for both, conflating two distinct versions into a single BOM entry.

Fix: NpmDependencyConverter.convertLockPackagesToNpmDependencies now stores the lockfile map key (the alias, e.g.
react-is-18) as NpmDependency.name. Each alias resolves to a unique NpmDependency so both versions reach
the BOM. As a consequence, the alias-mapping in GraphTransformer became redundant and was removed. Lookups now work directly against the alias key.

Problem 2 — Both detectors: transitive aliases invisible in the BOM

When an intermediate dependency declares alias dependencies in its own subtree, neither
detector reported them.

Fix: Covered by the same change above. Because alias keys are now the native lookup name in every NpmDependency, transitive aliases are found the same way as normal dependencies.

CLI detector root cause: npm ls --json outputs only the alias key and version (e.g. "react-is-18": {"version": "18.3.1"}). The alias map was built exclusively from the root package.json, so transitive aliases were invisible to it.

Fix: NpmCliExtractor.extract() now scans node_modules and crates a map of alias to real packages. npm itself writes node_modules folder so we have to go there to get the information missing from the CLI command. This supplemental map is then merged with the package.json derived map before processing, covering both root and transitive aliases.