Using file as a version in a package-lock.json creates a SPDX package without versionInfo (Non-NTIA compliant)

Using file as a version in a package-lock.json creates a SPDX package without versionInfo (Non-NTIA compliant) #232