[Bug]: pnpm detector rejects multi-document lockfiles

Describe the bug

The pnpm detector passes the complete pnpm-lock.yaml text to YamlDotNet's single-document Deserialize<T> API. Valid pnpm lockfiles can contain two YAML documents: an environment document followed by the project dependency document. Detection fails at the second DocumentStart, and the entire lockfile is skipped.

Pnpm documents this format and explicitly advises vulnerability scanners to read every document: https://pnpm.io/lockfile

Steps to reproduce

Create pnpm-lock.yaml with a minimal environment document and project document:

---
lockfileVersion: '9.0'

importers:
  .:
    configDependencies: {}
    packageManagerDependencies:
      pnpm:
        specifier: 12.3.4
        version: 12.3.4

packages:
  pnpm@12.3.4:
    resolution: {integrity: sha512-placeholder}

snapshots:
  pnpm@12.3.4: {}

---
lockfileVersion: '9.0'

settings:
  autoInstallPeers: false

importers:
  .:
    dependencies:
      fast-uri:
        specifier: 3.1.7
        version: 3.1.7

packages:
  fast-uri@3.1.7:
    resolution: {integrity: sha512-placeholder}

snapshots:
  fast-uri@3.1.7: {}

Run Component Detection against the directory containing this file.

Actual behavior

The detector logs an error and records zero pnpm components:

Failed to read pnpm yaml file .../pnpm-lock.yaml
Expected 'StreamEnd', got 'DocumentStart'

The stack reaches PnpmParsingUtilitiesFactory.DeserializePnpmYamlFileVersion, which calls Deserializer.Deserialize<PnpmYaml> once over the entire stream.

Expected behavior

Parse every YAML document and record the union of components from the environment and project documents. Single-document lockfiles must continue to work unchanged. If documents declare inconsistent lockfile versions, fail the file clearly rather than selecting a detector silently.

Which version of the tool was used?

Microsoft.ComponentDetection.Detectors 7.1.13+469778f6091a34f9888069cf66497bdee888b079

Command

ComponentDetector detect --SourceDirectory <repro> --Output <output> --LogLevel Verbose --MaxDetectionThreads 1

Additional context

The current pnpm parser uses YamlDotNet's single-document deserializer in both PnpmParsingUtilitiesFactory.DeserializePnpmYamlFileVersion and PnpmParsingUtilitiesBase.DeserializePnpmYamlFile. Pnpm's environment document may include real config and package-manager dependencies, so scanners should process both documents rather than discarding the first one.

Start in PnpmParsingUtilitiesFactory.DeserializePnpmYamlFileVersion and PnpmParsingUtilitiesBase.DeserializePnpmYamlFile, where the single-document YamlDotNet deserializer is used. Reproduce with the two-document pnpm-lock.yaml shown, then trace how both documents are combined and how lockfile-version mismatches are reported. Done means components from both documents are recorded, single-document files still work, and inconsistent versions fail clearly.