tests: add testbed for dev-dependencies of workspaces

[RickTimmer]

Description

As requested in #563.

This PR adds some testbeds proving an issue, here we can see that after creating the bill of materials with the --production flag we still see the "is-number" package show up. This is a devDependency of a child workspace, which is caught because of a bug concerning virtualized workspaces. The reason for the virtual workspace being used is the fact that the child workspace uses a peerDependency (Intended by Yarn/Berry design).

(personally I just used grep for a quick confirmation grep -c is-number tests/_data/snapshots/prod-arg_workspace-peer-dev-dependencies.json.bin)

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: Claude (claude.ai)
  • LLMs and versions: Claude Opus 4.8
  • Prompts: e.g Diagnosing why --prod includes transitive workspace devDependencies, Generate test-suite for this case, and fill in this PR description form

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[jkowalleck]

Please add a README to the new test bed: tests/_data/testbeds/workspace-peer-dev-dependencies/README.md

it should hold the details of this test bed, and what it is showcasing, along with its specialties.
Also add a link to the respective ticket 563.
This README could basically be a modified version of this PR's description.

Thank you in advance.

[jkowalleck]

add a remark that this is about dev-dependnecies of workspaces.

[jkowalleck]

some snapshots seam outdated
https://github.com/CycloneDX/cyclonedx-node-yarn/actions/runs/30039749554/job/89430772060?pr=564#step:8:258

'      <name>demo-workspace-peer-dev-dependencies-child</name>\n' +
+   '      <version>0.0.0</version>\n' +
-   '      <version>0.0.0-use.local</version>\n' +
    '      <description>demo: child for regression test transitive dev dependency omission with --prod flag in virtual workspace</description>\n' +
+   '      <purl>pkg:npm/demo-workspace-peer-dev-dependencies-child@0.0.0</purl>\n' +
-   '      <purl>pkg:npm/demo-workspace-peer-dev-dependencies-child@0.0.0-use.local</purl>\n' +
    '    </component>\n' +

[RickTimmer]

Hi, thanks for having a look again. I took care of your remarks, have another look. After it's been merged I'll rebase my fix branch. Let me know if you'd prefer to first see the CI fail based on the diff in the snapshots, or whether just the diff in the snapshots is fine. Kind regards