Add package.json dependecis parsing

[SzymonDrosdzol]

Adds parsing dependencies from package.json files.

Opt-in, needs to be enabled in config. Full command:

go run ./binary/scalibr/scalibr.go 
    --root ~/Documents/projects/test-project \
    --plugins javascript/packagejson \
    --plugin-config='javascript_package_json:{include_dependencies:true include_dev_dependencies:true include_optional_dependencies:true include_peer_dependencies:true}' \
    -o cdx-json=./result.cdx.json

[alessandro-Doyensec]

Is there a reason why only using append here would be wrong?

[SzymonDrosdzol]

I thought I understood the question, but the more Iook at it the less I see any ways that append could make it simpler while preserving the logic.
Can you give an example?

[alessandro-Doyensec]

I guess a better questions would be:

1. Can the code be refactored to directly modify pkgs[key].depGroups?
2. Is using slices.Clone, slices.Sort(merged) and slices.Compact(merged) actually needed?

[SzymonDrosdzol]

• refactored len(d.depGroups) == 0 to a separate function to better convey its purpose
• Added some comments
• Removed slices calls

Please verify @alessandro-Doyensec

[alessandro-Doyensec]

LGTM 🚀

[v1ktor0t]

lgtm 🚀