Root package-lock.json fails to parse in dependency graph detector

## Summary

The `component-detection-dependency-submission-action` step in `dependency-review.yml` fails to parse the root `package-lock.json`, so root npm dependencies may not be fully enumerated in the dependency graph submitted for review.

The job still succeeds, so this fails silently.

## Evidence

From the Review Dependencies job on PR #2514:

```text
[INF] Could not parse JSON from /home/runner/work/hve-core/hve-core/package-lock.json file.
System.Text.Json.JsonException: The JSON value could not be converted to System.String.
Path: $.license | LineNumber: 5 | BytePositionInLine: 18.
---> System.InvalidOperationException: Cannot get the value of a token type 'StartArray' as a string.
at System.Text.Json.Utf8JsonReader.GetString()
at System.Text.Json.Serialization.Converters.StringConverter.Read(...)
```

The detector expects `license` to be a string but encounters an array. The failure is in a transitive package entry within the lockfile rather than in the root manifest, which has no `license` field.

## Impact

Root-level npm dependencies may be missing from the submitted dependency snapshot. Since `dependency-review-action` evaluates that snapshot, advisories or license violations in root dependencies could go unreported.

Neither `docs/docusaurus/package-lock.json` nor `evals/beval/package-lock.json` produced this error in the same run.

## Suggested investigation

* Identify the lockfile entry with an array-valued `license` field.
* Determine whether the array form is valid per the npm lockfile schema. If it is, this is an upstream limitation in the detector and worth reporting to `advanced-security/component-detection-dependency-submission-action`.
* Consider whether the detector step should fail loudly on parse errors rather than continuing with an incomplete graph.

## Notes

Observed while triaging an unrelated dependency review failure on PR #2514. Not introduced by that PR; the root lockfile is unmodified there.