Improve type safety for component deduplication cache

[Copilot]

Addresses type safety feedback on PR #1456 regarding the pkgs Record type in extractor.ts.

Changes

• Changed pkgs type from Record<string, CDX.Models.Component> to Record<string, CDX.Models.Component | undefined> to correctly model index access behavior
• Removed redundant type assertion as undefined | typeof pkgs[keyof typeof pkgs]
• Added .filter(isNonNullable) to return statement to satisfy type constraints

Rationale

Index access on Record<K, V> returns V | undefined at runtime when the key doesn't exist. The original type was inaccurate and required workaround type assertions. The updated type correctly reflects this behavior:

const pkgs: Record<string, CDX.Models.Component | undefined> = {}
// ...
let component = pkgs[pkg.path]  // correctly typed as Component | undefined
if (component === undefined) {
  component = this.makeComponent(pkg, collectEvidence, logger)
  pkgs[pkg.path] = component
}

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.