pnpm devDependencies are included in SBOM by default

If I understand correctly from https://github.com/anchore/syft/issues/2348 and https://github.com/anchore/syft/pull/3371 , depDeps are excluded when using package-lock.json . However for pnpm lock files,, I am seeing dev deps output in the SBOM by default.

Start by reproducing the reported pnpm lock-file case and compare its SBOM output with the package-lock.json behavior described in the issue. Trace the dependency classification used during pnpm package discovery; done means pnpm devDependencies are excluded from the default SBOM consistently with package-lock.json.

Written by the indexing model from the issue text.