[BUG] @npmcli/arborist Report metadata count not correct

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

when use @npmcli/arborist to refiy a package and use json formate report it will return result:

    nodes:
      - node_modules/update-notifier
    fixAvailable:
      name:          @cloud/sfe-updater
      version:       1.0.23
      isSemVerMajor: true
metadata:
  vulnerabilities:
    info:     0
    low:      0  //not count out number
    moderate: 0  //not count out number
    high:     0  //not count out number
    critical: 0.   //not count out number
    total:    13
    null:     NaN
  dependencies:
    prod:         392
    dev:          0
    optional:     2
    peer:         0
    peerOptional: 0
    total:        393

Expected Behavior

it should be count right number of vulnbilities

Steps To Reproduce

code samples:

// fetch  advisories
const advisories = await got(this.vulnAPI, {
            method: 'post',
            headers: { 'Content-Type': 'application/json' },
            responseType: 'json',
            json: {
                versions: payload,
                ecosystem: 'npm',
            },
            https: { rejectUnauthorized: false },
        }).json();

// do check
const apt = new AuditReport(virtualTree, options);
const init = Object.getOwnPropertySymbols(AuditReport.prototype).find((sym) => sym.toString() == 'Symbol(init)');
apt.report = advisories;
await apt[init]();

return apt.toJSON();

Environment

"@npmcli/arborist": "^5.6.2"

Start by reproducing the supplied example with @npmcli/arborist 5.6.2 and inspect AuditReport initialization and toJSON(). Compare the vulnerability metadata counts with the advisories assigned to apt.report. Done means the JSON report counts each severity correctly and no longer returns zero, NaN, or an incorrect total.