Error when running scan_codebase on npm package using a download url source

[JonoYang]

When running the scan_codebase pipeline on an npm package input from a download url source (e.g. https://github.com/gravitational/teleport/archive/refs/tags/v17.1.4.tar.gz), the following exception occurs:

'str' object has no attribute 'location'

Traceback:
  File "/opt/scancodeio/aboutcode/pipeline/__init__.py", line 199, in execute
    step(self)
  File "/opt/scancodeio/scanpipe/pipelines/scan_codebase.py", line 63, in scan_for_application_packages
    scancode.scan_for_application_packages(self.project, progress_logger=self.log)
  File "/opt/scancodeio/scanpipe/pipes/scancode.py", line 409, in scan_for_application_packages
    assemble_packages(project=project)
  File "/opt/scancodeio/scanpipe/pipes/scancode.py", line 466, in assemble_packages
    for item in items:
                ^^^^^
  File "/opt/scancodeio/.venv/lib/python3.12/site-packages/packagedcode/npm.py", line 139, in assemble
    workspace_members = cls.get_workspace_members(
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/scancodeio/.venv/lib/python3.12/site-packages/packagedcode/npm.py", line 444, in get_workspace_members
    if NpmPackageJsonHandler.is_datafile(resource.location) and fnmatch.fnmatch(

Using the scan_single_package pipeline works just fine.

[JonoYang]

I think the issue is around here (https://github.com/aboutcode-org/scancode-toolkit/blob/develop/src/packagedcode/npm.py#L447) where the we should get the Resource for workspace_root_path and iterate on Resources. Right now, it is iterating through the string workspace_root_path.