feat(scanner) add dev flag in library

[sadayuki-matsuno]

Summary

Move dev dependency detection control from AnalyzeLibrary (scanner) to DetectLibsCves (detector).

Changes

• Add DetectDevLockfilePaths field to TrivyOpts
• Scanner now always includes dev dependencies (preserves Dev flag)
• DetectLibsCves skips vulnerability detection for dev dependencies unless the lockfile path is specified in DetectDevLockfilePaths
• Remove includeDevDependencies parameter from AnalyzeLibrary

Usage

  [trivyOpts]
  detectDevLockfilePaths = [
    "path/to/package-lock.json",
    "path/to/yarn.lock"
  ]

Only the specified lockfiles will detect vulnerabilities in dev dependencies. If not specified, dev dependencies are skipped (default behavior).

[MaineK00n]

📖