Expand dependency formats in existing language package parsers

[andrew]

Several existing parser packages support the main package manager but miss adjacent declaration, lock, and package metadata files found in other dependency parsers. Track those additions together while allowing each checkbox to land independently.

• JVM: add Gradle libs.versions.toml version catalogs, *.module metadata, Ivy-style dependencies.properties and *-dependencies.properties, build.sbt.lock, *.pom, and bounded OSGi dependency extraction from META-INF/MANIFEST.MF.
• NuGet: add central package management declarations from Directory.Packages.props.
• Clojure: add deps.edn and bb.edn dependency declarations.
• Go: register go.mod.graph and go.modgraph as additional filenames on the existing go.graph parser (go mod graph output).
• Haskell: add stack.yaml and cabal.project.
• vcpkg: add classic port dependencies from ports/*/CONTROL.
• Python: add requirements*.in, requirements/**/*.in, named pylock.*.toml files, and pip-inspect.deplock.
• npm family: add pnpm catalogs from pnpm-workspace.yaml, legacy shrinkwrap.yaml, Yarn Plug'n'Play dependency state from .pnp.cjs, and legacy binary bun.lockb.
• Erlang and Elixir: add rebar.config and OTP dependency metadata from *.app.src.

Each completed checkbox should include parser registration, unit tests, fixtures, and README entries. Preserve declaration versus resolution semantics, scope, directness, integrity, sources, and PURLs where the source format provides them.