feat: improve Bun parser to preserve multiple dependency paths to the same package

The pnpm parser was updated (#335) to preserve multiple dependency paths when the same package@version appears via different parent chains. The Bun parser has the same underlying problem — it currently collapses or approximates parent paths, meaning remediation output can only describe one path when a transitive package is reachable via multiple parents.

Impact: When a transitive vulnerability has multiple paths to it, the CLI may generate a fix command that only targets one parent. The output correctly marks these as path-specific, but users need all relevant paths to understand the full remediation scope.

Work to do:

• Audit the Bun lockfile parser (src/parsers/bun*.ts) for cases where multiple paths to the same package@version are collapsed into one
• Preserve all distinct paths using bounded traversal (same approach as the pnpm fix in #335)
• Add regression tests using a Bun lockfile fixture with a package reachable via multiple parents
• Run npm test && npm run build

Keep this separate from remediation wording changes — this is purely about path discovery accuracy.