feat: track direct vs transitive dependencies (v0.4.0)

[pkuzco]

Summary

The npm parser already scanned every package in package-lock.json, but treated everything as if it were a direct dep — so a CVE in a 5-level-deep transitive gave no clue which top-level package to update. This PR makes direct/transitive a first-class concept.

• Adds isDirect: boolean and via?: string to Dependency and DependencyResult
• npm: marks direct deps from packages[""].dependencies; runs BFS over the reverse-dep graph from package-lock.json to resolve the via direct dep for each transitive
• PyPI: adds Pipfile.lock parser (JSON, preferred over requirements.txt when present); uses _meta.pipfile.packages to tag direct vs transitive
• New --direct-only CLI flag and matching direct-only action input
• Table output appends via <name> for flagged transitives so users know which direct dep to update
• Markdown output adds a Path column (direct / via X / transitive)
• 8 new tests; bumps version to 0.4.0

Smoke test

mkdir t && cd t && npm i express@4.18.2 lodash@4.17.21
ossrisk .

→ 69 deps detected (2 direct + 67 transitive). All transitives correctly attributed to express via the BFS path. Flagged transitives show via express in the details column.

ossrisk . --direct-only

→ 2 deps (express, lodash).

Why

Without this, a transitive CVE was both undetectable (when only package.json was used) and unactionable (when the lockfile was used, but the user couldn't tell where the vulnerable package came from). Pulling in Pipfile.lock does the same expansion for Python users.

Test plan

• npm test — 8 new tests, 91 total, all green
• npm run build — clean
• Smoke test on real npm i tree confirms direct/transitive split and via accuracy
• --direct-only correctly filters to top-level deps
• CI runs against this branch

🤖 Generated with Claude Code