npm: package-lock license decoding to accept string or array

[Mikcl]

Fixes #1479

Introduces new decoding behaviour for the license field in package-lock.json packages. To accept a string and array as the datatype.

Previously: only a string was an expected value. This would mean the decoding step would fail in the event of an array being present, and all the remaining dependencies in the package-lock.json would not be cataloged.

This PR:

1. Accepts either a string or an array.
2. If its neither string or array and unable to parse the license field. Sets license to nil and does not error to allow us to capture the remaining package dependencies (at the expense of perhaps an unexpected license field not being captured).

• Have created the new packageLockLicense type with overriden UnMarshallJSON behaviour to create this change.
• Added test cases from an example package-lock.json

[kzantow]

This looks great @Mikcl just one suggestion

[Mikcl]

Thanks for the quick review @kzantow

Updated with the feedback :)

[Mikcl]

Note the "CLI tests" failing are not from changes in the PR but from upstream/main.

Update: Passes Now