feat: improve Yarn parser to preserve multiple dependency paths to the same package

[sonukapoor]

The pnpm parser was updated (#335) to preserve multiple dependency paths when the same package@version appears via different parent chains. The Yarn parser has the same underlying problem — it currently collapses or approximates parent paths, meaning remediation output can only describe one path when a transitive package is reachable via multiple parents.

Impact: When a transitive vulnerability has multiple paths to it, the CLI may generate a fix command that only targets one parent. The output correctly marks these as path-specific, but users need all relevant paths to understand the full remediation scope.

Work to do:

• Audit the Yarn lockfile parser (src/parsers/yarn*.ts) for cases where multiple paths to the same package@version are collapsed into one
• Preserve all distinct paths using bounded traversal (same approach as the pnpm fix in fix: preserve multiple pnpm dependency paths for repeated package versions #335)
• Add regression tests using a Yarn lockfile fixture with a package reachable via multiple parents
• Run npm test && npm run build

Keep this separate from remediation wording changes — this is purely about path discovery accuracy.