Support parsing: legacy Bun binary lockfile (bun.lockb)

[mstykow]

Follow-up issue for legacy Bun binary lockfile support after text bun.lock parsing lands.

Current scope already covered separately:

• text-based bun.lock parsing
• Bun sibling assembly with package.json
• Bun workspace lockfile hoisting for root lockfile dependencies

Remaining work:

• investigate whether static parsing of bun.lockb is practical without invoking Bun
• decide whether legacy bun.lockb should be parsed directly, partially recognized, or intentionally left as migration-only input
• preserve parity expectations with Bun's official migration guidance and any remaining real-world legacy usage

Related upstream issue: aboutcode-org/scancode-toolkit#4835

[mstykow]

Partial progress is now in PR #363: legacy bun.lockb format v2 compatibility is implemented statically, while current-format v3 support and remaining parity extras stay in this issue.