fix(npm): do not detect package-lock.json in node_modules as an app

[nikpivkin]

Prepare env:

npm init -y
npm add [email protected]
npm add [email protected]

Run Trivy:

trivy fs --list-all-pkgs -f json -o report.json .

Trivy detects package-lock.json in node_modules as applications:

cat report.json | jq '.Results[] | .Target'
"node_modules/combined-stream/yarn.lock"
"node_modules/form-data/yarn.lock"
"node_modules/html2canvas/node_modules/css-line-break/package-lock.json"
"node_modules/html2canvas/package-lock.json"
"node_modules/uri-js/yarn.lock"
"package-lock.json"