SCIO: Resolve npm dependencies based on lockfiles

[pombredanne]

I would like to have a pipeline (likely an addon pipeline) that can resolve the dependencies given this context:

• We have a project with a package.json and a package-lock.json or yarn.lock (and the future pnpm)
• We should be able to create the new "resolved" packages and the relationship using the new models and this data
  • RFC: Design improved relationships for Package, Dependencies, Embeds and Requirements  #1066

We also need the same elsewhere:

• SCTK: resolve npm dependencies based on lockfiles, using a new option scancode-toolkit#3780