Harden dependency resolution and npm audit edge cases

Make arbitrary-ref dependency probing more tolerant of parser shape errors and
mark curated scans as incomplete when curated dependencies fail to resolve.

Tighten npm audit handling by:
- recording discovery failures and empty installed bundle trees as incomplete
- generating prod-only lockfiles with --package-lock-only when no lockfile is present
- retrying ENOLOCK recovery even when node_modules exists without a lockfile
- handling boolean bundleDependencies and avoiding duplicate installed-tree walks
- skipping invalid GitHub advisory specifiers or versions per advisory
- normalizing npm advisory IDs across modern and legacy audit payloads

Author: santigimeno

dep_checker/main.py

@@ -395,7 +395,7 @@ def main() -> int:
 
             from npm_audit import NPMAuditChecker
             print("Running npm package vulnerability audit...", file=sys.stderr)
-            npm_checker = NPMAuditChecker(repo_path, npm_timeout)
+            npm_checker = NPMAuditChecker(repo_path, npm_timeout, gh_token=gh_token)
             npm_vulnerabilities = npm_checker.check_npm_vulnerabilities(Vulnerability)
             if npm_checker.failed_packages:
                 scan_complete = False