fix: Support pnpm lockfile keys in dependencies (#3461)
Fixes #3382
This PR adds support for when pnpm encodes a dependency version as a
lockfile key instead of just a version. We already have similar logic in
the npm lockfile implementation.
Thanks to @omarahm3 for the reproduction!
