feat(composer): add dependency relationships

[Xenira]

Description

Adds dependency relationships for composer.lock and installed.json files

Type of change

• New feature (non-breaking change which adds functionality)

Checklist

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

Issue references

Collective issue for all types:

Refs: #572

[CAOShurong]

Reviewed exact head e49c9f0 against base d3734dd. The new Composer resolver handles package names and provide aliases, but it drops Composer replace aliases.

Composer documents replace as satisfying requirements for the replaced package. In an exact-head composer.lock fixture where acme/implementation replaces acme/virtual and acme/application requires acme/virtual, parsing returns both packages but zero relationships; the provide-equivalent produces the expected relationship. Please parse replace metadata for both lock and installed entries, include those names in the resolver's provided set, and add a regression.

The existing Composer tests passed 20/20, parser-focused tests and package-scoped go vet passed. GitHub currently exposes only a successful DCO check for this head. git diff --check also reports an added blank line at dependency_test.go:255.

I used AI assistance to help inspect the change, check Composer's primary documentation, and run the reproducer; I verified the exact diff and results before submitting this review.

[Xenira]

@CAOShurong thanks for the review.

I have added support for the replace property. Also added a new composer.lock to the testdata that contains a real world example using replace. Old packages but the simplest example I found.

The existing Composer tests passed 20/20, parser-focused tests and package-scoped go vet passed. GitHub currently exposes only a successful DCO check for this head.

Not sure if I need to do anything here. If so could you be a little more specific?