### Description

Fixes #4133 (huge thanks to @shawnmcknight for the reproduction)

The crux of the issue was that if a dependency is patched and peer
dependencies than both get encoded into the lockfile key. We can't
construct a full expected lockfile key from the patch entry anymore as
the patch entry doesn't contain information about peer dependencies. To
circumvent this we now scan through the entire package list, parse the
key, extract the patch hash (if present), and then check if it matches a
patch listed in `patchedDependencies`.

Notes for reviewers:
- A large portion of this PR is actually porting the lockfile key
parsing logic that pnpm itself uses so we can extract the individual
pieces that we care about. This logic is in a slightly messy state as
the pnpm codebase is currently in a state where it supports v5 and v6
lockfiles. As mentioned in pnpm/pnpm#5810 once
pnpm@8 lands this code will start to be refactored. I tried to keep the
Go port as 1:1 as possible in hopes to make future maintenance easier.
- This PR includes new logic for v6 as pnpm now encodes patches in
lockfile keys: pnpm/pnpm#5979

### Testing Instructions

Added new packages to the pnpm lockfile fixtures that are patched *and*
have peer dependencies.

Also verify that the changes work as expected with the provided repro:
 - `make turbo`
 - Clone https://github.com/shawnmcknight/turbo-pnpm-patch-repro
- Remove private dependency: `pushd packages/test && pnpm rm @sheet/core
&& popd`
 - `turbo_dev --skip-infer prune --scope=test`
- Verify that `out/pnpm-lock.yaml` contains a `patchedDependencies`
section with both `@types/jsonwebtoken@8.5.9` and `moleculer@0.14.28` as
entries