Gather full origin information for NPM packages detected from .lock files

Currently in scancode.io/scancode-toolkit, we can reliably detect NPM packages and their origin info from a standard `package.json` file, which usually has entries for license + other origin information.

When a package is detected from a lockfile, we only have name, version information. We should incorporate a step in the pipeline that calls out the npm registry with the name, version info to get the full set of package information.