Add support for Yarn lockfiles (yarn.lock)

Currently, `lockcheck` parses `package-lock.json` directly. However, a massive portion of the ecosystem uses Yarn.

We need to implement a parser for `yarn.lock` files.
Since we want to remain a **zero-dependency** tool, we cannot pull in external YAML or Yarn parsers. The goal is to write a lightweight, native scanner inside `src/parsers/yarn.js` that extracts the package name, resolved URL, and integrity hashes from the `yarn.lock` format, and maps them to our normalized `PackageInfo` map so that the existing 6 security analyzers can run against it seamlessly.

**Acceptance Criteria:**
- Detect if `yarn.lock` is present instead of `package-lock.json`.
- Successfully parse `yarn.lock` into the `packages` Map format.
- Output should be the same terminal report as npm.