fix: resolve SBOM dependency edges from the lock graph

[sonukapoor]

The SBOM dependency graph reconstructed parent edges by prefix-matching PackageRef.paths, which upsertPackage caps at five per package. On a large tree that discards a lot. Measured on examples/lit, 592 of 2549 packages exceed five paths, with semver@6.3.1 alone having 49 and glob@7.2.3 having 33. When the five surviving routes all traverse packages excluded from the scan, the prefix lookup finds nothing and the package ends up with no parent edge.

The lock graph already had the answer

parentsFor() is a public, pre-frozen, complete child-to-parents map on the npm lock graph, and the display cap never touches it. So no second traversal and no raised cap were needed, which removes the performance question that made this look expensive on the issue. The five-path bound stays where it earns its place, in remediation output, where a representative route is enough.

Two cases beyond the straight lookup

Workspace members are symlinked rather than installed, so the graph records them without a version and they never appear in the scanned package set. Their dependencies were being dropped entirely, which is what most of the orphans on lit actually were.

--prod-only shrinks the package set without shrinking the graph, so an edge can name a package absent from the document.

Both now anchor to the root project rather than orphaning the package. It is genuinely in the tree, and the root is the only anchor the document can offer. Emitting a reference to a package that is not in the document would be a dangling SPDX reference, which never happens.

Measured on examples/lit

DEPENDENCY_OF edges:       2664  ->  4082    (+53%)
packages with no parent:    111  ->     1
dangling references:                      0

The single remaining orphan is @lit-internal/monorepo, the root project, which correctly has no parent.

Non-npm ecosystems

pnpm, Yarn and Bun have no lock graph, so the resolver returns an empty list and path-derived behaviour is kept. That fallback is selected by length rather than truthiness: an empty array is truthy, and checking the reference alone silently emptied the graph for every non-npm ecosystem. Caught during verification and pinned with a test. Verified on examples/astro: 3513 edges retained.

Verification

1790 tests, build clean, docs site builds. Both new code paths mutation-tested: disabling buildEdgesFromResolved fails 2 tests, removing the root-anchoring fallback fails 3.

The SPDX guide previously documented this as a limitation for all projects. It now splits by package manager, since npm is complete and the others are not, rather than implying the graph is exhaustive everywhere.

Closes #1079