deno.json import map entries that are not npm: or jsr: get invented pkg:deno identities #116

Found while working on #115.

parseDenoSpec in internal/npm/deno.go recognises npm: and jsr: specifiers and skips https: URLs. Every other value falls through to return spec, "", so the raw specifier becomes the dependency name. Parse then builds a pkg:deno PURL from it, which invents a package identity for things that are not packages.

Reproduce

content := []byte(`{"imports": {
  "chalk": "npm:chalk@5.3.0",
  "$utils/": "./src/utils/",
  "std/": "http://deno.land/std@0.200.0/",
  "react": "https://esm.sh/react@18",
  "fs": "node:fs"
}}`)
result, _ := manifests.Parse("deno.json", content)
for _, dep := range result.Dependencies {
    fmt.Printf("%q -> %q\n", dep.Name, dep.PURL)
}

Problems

• Local paths, remote URLs and node: builtins are reported as dependencies with pkg:deno PURLs that do not identify any package.
• http: and https: URLs are handled differently: one becomes a dependency, the other is silently dropped.
• The dependency name is the raw specifier rather than a package name.

Possible fix

#115 adds Dependency.NoPURL for source-only entries whose package identity is unknown. Remote URL imports (http: and https: alike) could be kept as source-only entries with NoPURL: true and a Source of kind url holding the literal value. That matches how direct download URLs are meant to be represented. Local paths could use a path source the same way, or be skipped. node: builtins ship with the runtime, so they are probably better skipped than reported.

Tests should go through public Parse and cover each specifier form above.