[K9VULN-14431] Add Bun lockfile parser

[rjcoulter22]

🚀 Motivation

SCA currently does not extract dependencies from bun.lock, so Bun projects are missing SBOM coverage. This PR adds Bun lockfile support and preserves the manifest dependency specifiers needed to enrich direct dependencies from package.json.

📚 Documentation

Document	Link or Detail
RFC	N/A
Incident	N/A
Jira Ticket	K9VULN-14431

📝 Summary

Adds a bun.lock extractor for JavaScript projects.

Parser behavior:

• Registers bun.lock and the Bun package manager
• Extracts package name, resolved version, and git commit details from Bun package tuples
• Handles scoped packages, file dependencies, malformed JSON, empty tuples, and non-string package specs
• Skips lockfiles nested under node_modules

Package.json enrichment:

• Reuses the existing PackageJSONMatcher
• Parses Bun workspaces dependency sections to preserve declared specifiers such as ^4.17.21
• Uses those specifiers as TargetVersions so direct/dev dependencies receive IsDirect, dependency groups, and manifest locations

🧪 Testing

• New tests were added for new logic.
• Existing tests were updated for new logic, and not only so that they pass!
• Benchmark results prove that performance is the same or better.

Cross-scanner verification:
Compared this branch against Trivy 0.70.0 on kriasoft/react-starter-kit, a Bun monorepo with a 4,648-line bun.lock.

Metric	Datadog	Trivy
Raw CycloneDX PURLs	1,922	2,185
Canonical name@version packages	1,922	1,932

• After canonicalizing Trivy's Bun dependency-path PURLs to resolved name@version, every package emitted by Datadog is also emitted by Trivy (0 Datadog-only canonical packages).
• Trivy's extra raw PURLs are modeling differences: it can emit a separate PURL for each nested lockfile path key, even when multiple paths resolve to the same (name, version).
• The remaining 10 Trivy-only canonical packages were local workspace packages such as @repo/api, @repo/web, and @repo/ui, which we intentionally skips instead of reporting as third-party npm components.

🆘 Recovery

Notes for on-call - select only one:

• The change can be rolled back.
• Do not roll back. Why?:

[datadog-datadog-prod-us1]

🎯 Code Coverage (details)
• Patch Coverage: 96.77%
• Overall Coverage: 84.79% (+0.04%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 59f650c | Docs | Datadog PR Page | Give us feedback!}

[rjcoulter22]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 12a0540e11

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3edab337e3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 59f650c9bf

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[anderruiz]

LGTM