get correct resolved/version for remote packages

[joshclow]

When shrinkwrapping a remote dependency, use the package's version instead of resolved in getChildVersion (because resolved will be the URL to the package which semver will be very unhappy about later)
Additionally, grab the resolved value from a remote dependency as would be done for a registry dependency.

Resolves #17858

[iarna]

Hey, thanks for digging into this!

Per the spec, this should be the tarball URL: https://github.com/npm/npm/blob/latest/doc/spec/package-lock.md#version-changed

I've commented over in #17858 but there are two different bugs at play here. Fixing the crash-on-http-in-version field is the top priority, followed by improving the "generate a package-lock from an existing node_modules" path to add these as registry, not remote, dependencies.