fix: accept BOM in package manifests

[favoyang]

Summary

• add a shared package.json reader that strips a leading UTF-8 BOM before parsing
• use it for package discovery and artifact metadata generation
• add BOM regression coverage for both paths

Closes openupm/openupm#4135

Validation

• npm test
• npm run lint
• npm run format:check
• npm run typecheck

[favoyang]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".