Scan vendored npm via its installed bundle tree

Special-case deps/npm to avoid npm audit on npm's workspace source checkout.

When deps/npm has a valid installed tree, run npm ls --omit=dev --all --json,
walk the packages reachable from bundleDependencies, and query GitHub
advisories using exact installed versions.

This keeps the scan aligned with the vendored npm payload instead of trying to
synthesize a lockfile from the workspace checkout.

Also:
- normalize GitHub advisory ranges such as '= 8.0.0' before version matching
- prefer CVE identifiers when GitHub exposes one, otherwise fall back to GHSA
- add regression coverage for the deps/npm path.

Author: santigimeno

dep_checker/main.py

@@ -378,7 +378,7 @@ def main() -> int:
 
             from npm_audit import NPMAuditChecker
             print("Running npm package vulnerability audit...", file=sys.stderr)
-            npm_checker = NPMAuditChecker(repo_path, npm_timeout)
+            npm_checker = NPMAuditChecker(repo_path, npm_timeout, gh_token=gh_token)
             npm_vulnerabilities = npm_checker.check_npm_vulnerabilities(Vulnerability)
             if npm_checker.failed_packages:
                 scan_complete = False