PNPM improvements: scanning does not support v6 and can result in duplicate packages

[kzantow]

What happened:
When PR #1752 was merged, I overlooked the fact that duplicate packages can get created. This should be accounted for when adding the packages from both the dependencies and packages sections.

When attempting to add a test fixture for this, I used PNPM to make a basic React project and realized that Syft doesn't support the pnpm lockfile format v6.

What you expected to happen:
Syft scans both older (v4) and newer (v6) pnpm lock files. No duplicate packages.

Steps to reproduce the issue:
Use this modified PNPM lock file (remove the .txt extension or create a new one): pnpm-lock.yaml.txt