Fixture(#11)/multiple versions same pkg

[coder-Yash886]

Fixture(#11)

Summary

• Adds minimal npm fixture where lodash is installed at two versions: 3.10.1 (transitive via karma) and 4.17.20 (direct).
• Both vulnerable versions are reported as separate findings with correct direct/transitive classification.
• Adds regression test in fixture-scan.test.ts.

Scan output

```
node dist/index.js examples/multiple-versions-same-pkg --verbose
```

Parsed 3 packages. Found 3 packages (11 CVEs). Key findings:

• lodash@3.10.1 — critical, transitive
• lodash@4.17.20 — high, direct

Test plan

• npm run build
• npm test -- tests/fixture-scan.test.ts
• node dist/index.js examples/multiple-versions-same-pkg --verbose"

[coder-Yash886]

@sonukapoor Please review the PR when you have free time

[sonukapoor]

Clean fixture - both lodash versions correctly reported as separate findings. Tested locally.

[sonukapoor]

Merged - thank you @coder-Yash886!