fix: disable npm workspaces for native config reads

[omribz156]

Summary

This patch fixes the native npm config lookup path used by jf curation-audit --run-native for npm workspace packages.

When curation audit runs from a workspace package directory, npm 10 can infer workspace mode and reject npm config get registry with ENOWORKSPACES. The fix adds --workspaces=false to the native npm config get calls used for the registry and auth-token lookups, so curation can still read the project npm config without entering workspace mode.

This is related to the report in jfrog/jfrog-cli#3473; the curation implementation lives in this repository.

Verification

• Reproduced locally that npx npm@10.9.2 config get registry fails with ENOWORKSPACES from an npm workspace package directory, while adding --workspaces=false succeeds.
• go test ./sca/bom/buildinfo/technologies/npm
• go vet ./...
• git diff --check

Implemented with Codex assistance; I kept the patch focused and manually reviewed the final diff.

• The pull request is targeting the dev branch.
• The code has been validated to compile successfully by running go vet ./....
• The code has been formatted properly using go fmt ./....

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[attiasas]

Nice work!. Please add a comment to sign the CLA, update the branch with dev and check my comments

[attiasas]

🟡 Documentation

Please add a one-line comment on disableWorkspacesFlag / npmConfigGetArgs noting that npm 7+ can return ENOWORKSPACES for npm config get when cwd is a workspace package (see jfrog/jfrog-cli#3473).

[attiasas]

What about users with npm versions lower than the new flag? It will result in an error if the flag is unknown. Should we add a guard?

[omribz156]

Thanks for the review. I pushed 877cc0d with the technical fixes:

• rebased the branch onto current dev
• added the one-line comment explaining the npm 7+ workspace config issue
• guarded --workspaces=false so npm versions older than 7 do not receive the flag

Verification:

• go test ./sca/bom/buildinfo/technologies/npm
• git diff --check

CLA is still pending separately. This follow-up was Codex-assisted and manually checked before pushing.

[omribz156]

I have read the CLA Document and I hereby sign the CLA