Fix npm alias dependency parsing in npm verify

[Trighap52]

Summary

• parse npm alias selectors in package.json dependencies (npm:<package>@<selector>) before version resolution
• resolve alias entries to the underlying package name so scanner downloads the real package metadata
• preserve existing behavior for non-alias selectors (semver ranges, git URLs, GitHub shorthands)

Tests

• ~/.pyenv/versions/3.12.6/bin/python -m pytest -q tests/core/test_npm_requirements_scanner.py

Fixes #642