Feat/npm support scan of npm projects without lockfiles

[adrobuta]

• Ready for review
• Follows CONTRIBUTING rules
• Reviewed by Snyk internal team

What does this PR do?

Adds support for scanning npm projects that do not contain package.json/package-lock.json/yarn.lock files in the application root directory:

• Adding dependency to resolve-deps which can traverse node_modules directory and return a depgraph
• Adding functionality to persist the node_modules from the image layer to a temporary directory and passing the path to the call to resolveDeps library
• a depGraph is constructed when package.json or package.json and package-lock.json/yarn.lock is missing from the application directory
• when package.json is missing from the application directory, the name of the rootPkg is set to the parent dir of the node_modules folder and the version for it is reported being "1.0.0"
• when package.json is missing from the application directory, the default package manager reported for the depGraph is npm

Where should the reviewer start?

How should this be manually tested?

Any background context you want to provide?

What are the relevant tickets?

Screenshots

Additional questions

[team-lumos]

🎉 This PR is included in version 6.12.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀