Fix missing nested packages in package-lock.json v1

[Eljees]

Description

Catalog nested dependency entries in npm package-lock v1 files. Previously, Syft only visited the top-level dependency map, so conflicting versions installed below another package were missing from the SBOM.

This change:

• recursively walks nested v1 dependency maps
• keeps distinct package versions while deduplicating repeated name/version pairs
• skips complete dev-only subtrees when dev dependencies are disabled
• adds a multi-level regression fixture covering all three cases

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (please discuss with the team first; Syft is 1.0 software and we won't accept breaking changes without going to 2.0)
• Documentation (updates the documentation)
• Chore (improve the developer experience, fix a test flake, etc, without changing the visible behavior of Syft)
• Performance (make Syft run faster or use less memory, without changing visible behavior much)

Testing

• go test ./syft/pkg/cataloger/javascript -count=1
• go vet ./syft/pkg/cataloger/javascript

Checklist

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

Issue references

Fixes #5101

[Eljees]

I'm glad could have helped!!