fix(php): keep dependency edges to packages named like PHP extensions - #11051

Description

The composer.lock parser skips every require key whose name starts with ext to keep PHP platform extensions out of the dependency graph. Platform extensions are named with an ext- prefix (ext-json, ext-gd, ...), so the bare ext prefix also matches regular packages whose name starts with ext and drops their dependsOn edges.

pkg/dependency/parser/php/composer/parse.go:

if depName == "php" || strings.HasPrefix(depName, "ext") {
    continue
}

For a lock where acme/app requires extension/foo, the acme/app -> extension/foo edge is dropped, so the dependency graph no longer shows how extension/foo was pulled in. Packagist currently lists over 180 published packages whose name starts with ext but not ext-, for example extend/module-warranty and extcode/cart.

The fix skips a require entry only when its name has no vendor prefix (no /), as suggested in review. Composer platform packages (php, php-64bit, hhvm, ext-<name>, lib-<name>, ...) have no vendor, while a regular package name consists of a vendor name and the project's name (docs).

Test

Added a package name starts with ext case to the table-driven TestParse with a small lock where acme/app requires php, ext-json and extension/foo. It checks the packages and that only the edge to extension/foo is kept. On the commit before the original change the new case fails (no dependencies are returned); with this PR both TestParse cases pass.

go test ./pkg/dependency/parser/php/composer/...