fix(nodejs): merge Indirect, Dev, ExternalReferences fields for same deps from package-lock.json files v2 or later

[DmitriyLewen]

Description

There are times when package-lock.json contains 2 (or more) identical dependencies, but

• only one of these dependencies is Dev.
• only one of these dependencies is Indirect.

We need to combine these dependencies correctly.
Also we need to merge ExternalReferences rather than overwrite them.

Related issues

• Close npm: inconsistent results when dependency has both a dev and non-dev entry in lockfile #5139

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).