fix: excplicitely require direct dependency packageurl-js

[jkowalleck]

packageurl-js is a transitive dependency, that is true.
but it is also a direct dependency, see

cyclonedx-node-npm/src/builders.ts

Line 23 in e229098

import { type PackageURL } from 'packageurl-js'

Therefore, it is directly required, now

[codacy-production]

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
+0.00%	✅ ∅ (target: 80.00%)

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (e229098)	359	307	85.52%
Head commit (9302edb)	359 (+0)	307 (+0)	85.52% (+0.00%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#1122)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings    Change summary preferences