Show ecosystem and version even if git is shown if the info exists.

[another-rex]

Fixes #735

Also update composer.lock in our integration tests fixture to contain a vulnerability to catch this issue in the future.

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (ff7f2d6) 78.94% compared to head (ceb986e) 78.96%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #736      +/-   ##
==========================================
+ Coverage   78.94%   78.96%   +0.01%     
==========================================
  Files          85       85              
  Lines        6037     6037              
==========================================
+ Hits         4766     4767       +1     
+ Misses       1067     1066       -1     
  Partials      204      204              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[G-Rath]

I personally don't mind this change, but fwiw I'm pretty sure it means we're favoring versions over commits - while that'll generally look nicer it is arguably less accurate i.e. I can give an NPM package whatever name and version I like but I can't "forge" a commit.