fix: skip empty dependency names to prevent lockfile corruption

[hijingsong]

Problem

When package.json contains an empty-string dependency key (e.g., "": "."), Deno works on the first run but corrupts the lockfile. On the second run, deserialization fails with:

Invalid workspace section: Invalid package requirement '@.'

Fixes #32113

Root Cause

An empty dependency name passes through PackageJsonDepValue::parse("", ".") and gets serialized into the lockfile as an invalid package requirement. When the lockfile is read back, the deserializer cannot parse it.

Fix

Skip empty-string dependency names at two locations:

1. libs/package_json/lib.rs (resolve_local_package_json_deps): Filter out empty keys when building the dependency map. This prevents the invalid entry from entering the system at the parsing level.

2. libs/resolver/lockfile.rs (collect_deps): Filter out empty keys when collecting link package deps for the lockfile. Belt-and-suspenders defense for the lockfile path specifically.

Empty-string dependency names are not valid npm package identifiers and serve no purpose, so silently ignoring them is the correct behavior.

Testing

Manually verified with the reproduction case from #32113:

{
    "dependencies": {
        "": "."
    }
}

Before: lockfile corruption on second run. After: empty entry is silently skipped.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}