Panic while parsing pnpm lockfile

[spencerschrock]

While running Scorecard at scale, I came across a pnpm lockfile which caused osv-scanner to panic.
https://github.com/kne-union/react-form/blob/9dc3135f7d3d08ac7311871640590de4d1d223aa/example/pnpm-lock.yaml

The initial panic was found at commit 8aef177, but it can be reproduced at v1.2.0 as well:

osv-scanner --lockfile=./example/pnpm-lock.yaml

Which results in the panic of:

panic: runtime error: index out of range [0] with length 0

goroutine 1 [running]:
github.com/google/osv-scanner/pkg/lockfile.extractPnpmPackageNameAndVersion({0xc0009426f0?, 0x72fa3b?})
	~/go/pkg/mod/github.com/google/[email protected]/pkg/lockfile/parse-pnpm-lock.go:46 +0x218
github.com/google/osv-scanner/pkg/lockfile.parsePnpmLock({0xc000280000?, 0xc0009fef90?})
	~/go/pkg/mod/github.com/google/[email protected]/pkg/lockfile/parse-pnpm-lock.go:77 +0x158
github.com/google/osv-scanner/pkg/lockfile.ParsePnpmLock({0xc0001cb650, 0x30})
	~/go/pkg/mod/github.com/google/[email protected]/pkg/lockfile/parse-pnpm-lock.go:133 +0x1b6
github.com/google/osv-scanner/pkg/lockfile.Parse({0xc0001cb650, 0x30}, {0xc00002ef20, 0x0})
	~/go/pkg/mod/github.com/google/[email protected]/pkg/lockfile/parse.go:141 +0x29f
github.com/google/osv-scanner/pkg/osvscanner.scanLockfile(0xc0001d8a80, 0xc000012cf0, {0xc0001cb650, 0x30}, {0xc00002ef20, 0x0})
	~/go/pkg/mod/github.com/google/[email protected]/pkg/osvscanner/osvscanner.go:191 +0x20d
github.com/google/osv-scanner/pkg/osvscanner.DoScan({{0xc0001cf950, 0x1, 0x1}, {0x0, 0x0, 0x0}, {0xf45650, 0x0, 0x0}, {0x0, ...}, ...}, ...)
	~/go/pkg/mod/github.com/google/[email protected]/pkg/osvscanner/osvscanner.go:413 +0x2d1
main.run.func3(0xc0001d8500)
	~/go/pkg/mod/github.com/google/[email protected]/cmd/osv-scanner/main.go:108 +0x45d
github.com/urfave/cli/v2.(*Command).Run(0xc000190840, 0xc0001d8500, {0xc000024040, 0x2, 0x2})
	~/go/pkg/mod/github.com/urfave/cli/[email protected]/command.go:273 +0xa42
github.com/urfave/cli/v2.(*App).RunContext(0xc000234000, {0xb76e90?, 0xc0000260f0}, {0xc000024040, 0x2, 0x2})
	~/go/pkg/mod/github.com/urfave/cli/[email protected]/app.go:332 +0x616
github.com/urfave/cli/v2.(*App).Run(...)
	~/go/pkg/mod/github.com/urfave/cli/[email protected]/app.go:309
main.run({0xc000024040, 0x2, 0x2}, {0xb72d60?, 0xc000014018}, {0xb72d60?, 0xc000014020})
	~/go/pkg/mod/github.com/google/[email protected]/cmd/osv-scanner/main.go:127 +0x99e
main.main()
	~/go/pkg/mod/github.com/google/[email protected]/cmd/osv-scanner/main.go:153 +0x46