Misleading application package scans in Docker image

When running a Docker image scan, there is a step when the code is scanned for application packages (e.g. Maven, PyPI, npm, etc). Since ScanCode Toolkit treats application packages from lock files about the same as application packages from actual manifest there is a risk to misleading and over report with "ghost" packages that may exist in a lock files (such as a package-lock.json, yarn.lock, requirements.txt, etc.) which may be used in development as dependency but are not part of "production" dependencies that are effectively installed in the image.

We should handle this first here. Eventually scancode-toolkit should also tell if a reported package was actually real code that was found vs. only a reference in a lock file. And lock file references should be matched wit real code to be reportable (with some caveats where some minification/webpacking can throw a few monkeys well equipped with many wrenches in the game to make things more complicated and hide the fact that a package real code may be there because it is obfuscated)