--exclude-dev-deps doesn’t work with pnpm v9+ lockfiles

**What happened**:

after merging the fix to exclude dev/est deps for pnpm (#4430 , #4487), it only works for lockfiles before v9, since pnpm v9+ dropped the dev flag and need support v9+

**What you expected to happen**:

**Steps to reproduce the issue**:

**Anything else we need to know?**:

**Environment**:
- Output of `syft version`: latest
- OS (e.g: `cat /etc/os-release` or similar):

Start by tracing Syft's handling of the --exclude-dev-deps option for pnpm lockfiles and compare the existing pre-v9 behavior with the v9+ lockfile format, which no longer has the dev flag. Done means the option correctly excludes development and estimated dependencies from pnpm v9+ lockfiles while preserving earlier lockfile support.

Written by the indexing model from the issue text.