feat(scanner): keep NPM provenance (attestations) in the dependency version

[fraxken]

close #491

[changeset-bot]

🦋 Changeset detected

Latest commit: dfc4deb

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@nodesecure/scanner	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[Copilot]

Pull Request Overview

This PR adds support for NPM provenance attestations in dependency versions. The changes enable the scanner to capture and store attestation data from NPM packages, which provides cryptographic verification of package provenance.

Key Changes:

• Added attestations field to the DependencyVersion interface to store NPM provenance data
• Updated NpmRegistryProvider to collect and assign attestation information from package metadata
• Enhanced test coverage with a new test case verifying attestation data handling

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
workspaces/scanner/src/types.ts	Added attestations property to DependencyVersion interface using Dist["attestations"] type
workspaces/scanner/src/registry/NpmRegistryProvider.ts	Modified to extract and assign attestations from packument data to dependency versions
workspaces/scanner/test/NpmRegistryProvider.spec.ts	Added test case for attestations and explicit type annotations for warnings arrays
.changeset/twenty-planes-think.md	Added changeset documenting the new feature

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}