Use deprecated info from lockfile if available

[ericcornelissen]

I just discovered that package-lock.json can include "deprecated" information for dependencies. If this info is available, it should be used of getting the deprecation warnings through the npm CLI as it is more reliable (machine readable format, no network connection required) and avoids wasting resources (by re-installing dependencies).

As of writing, I don't know if this is available in all versions of package-lock.json or if other lockfiles (e.g. yarn.lock) include this info too.