perf(licenses): prefetch remote licenses concurrently for js lockfiles

[CAOShurong]

Fixes #5193

[CAOShurong]

Marked as draft while CI runs — will mark ready for review once checks pass. Full description below.

---

Problem

With --enrich javascript (or search-remote-licenses: true), each package constructor calls getLicenseFromNpmRegistry inline, so a lockfile with N entries makes N strictly sequential HTTP round-trips. For a ~1500-package pnpm-lock.yaml, the reporter measured ~10 minutes, almost all of it waiting on the registry.

The lookups are independent of one another, so there is no reason for them to serialize.

Change

• Add a shared bounded-concurrency helper, licenses.Prefetch(ctx, keys, n, fn) (worker pool, default 8), which logs rather than propagates individual failures.
• In the three JS lockfile parsers (package-lock.json, pnpm-lock.yaml, yarn.lock), collect the (name, version) pairs that will need a remote lookup and warm a per-parse in-memory cache with concurrent registry requests before constructing packages.
• The per-package constructors consult the cache first; on a miss they fall back to the original inline request path, so behavior (including error logging) is unchanged for anything the prefetch could not fetch.
• Treat HTTP 404 from the npm registry as an explicit error instead of trying to decode an error document as JSON.

Dev-dependency filtering and alias handling are applied before building the pair list, so no extra requests are issued for packages that would be skipped anyway.

Verification

• go build ./... exit 0; go vet clean on both touched packages
• go test ./syft/pkg/cataloger/internal/licenses/ -count=1 — all pass (4 new tests: every key attempted, empty-keys no-op, continue-after-error, concurrency high-water-mark ≤ limit)
• go test ./syft/pkg/cataloger/javascript/ -run "TestNpmLicensePrefetch" -count=1 -v — 4 new tests pass:
  • exactly one request per pair
  • no requests when SearchRemoteLicenses is false
  • concurrency proof: server holds each request open until all N arrive (would time out if serialized)
  • a failing lookup does not prevent later lookups
• Pre-existing failures in the package suite (Test_JavascriptCataloger, glob tests, yarn dev-dependency tests) reproduce identically on unmodified main via stash-run baseline — environment-dependent, untouched by this change.