fix(php): keep dependency edges to packages named like PHP extensions

[sueun-dev]

Description

The composer.lock parser skips every require key whose name starts with ext to keep PHP platform extensions out of the dependency graph. Platform extensions are named with an ext- prefix (ext-json, ext-curl, ...), so the bare ext prefix also matches regular packages whose name starts with ext and drops their dependsOn edges.

pkg/dependency/parser/php/composer/parse.go:

if depName == "php" || strings.HasPrefix(depName, "ext") {
    continue
}

For a lock where acme/app requires extension/foo, the acme/app -> extension/foo edge is dropped, so the dependency graph (and the SBOM dependsOn / vulnerability dependency path) no longer shows how extension/foo was pulled in. Packagist currently lists over 180 published packages whose name starts with ext but not ext-, for example extend/module-warranty and extcode/cart.

The fix matches the ext- prefix only.

Test

Added TestParse_ExtPrefixDependency with a small lock where acme/app requires php, ext-json and extension/foo. It checks that the edge to extension/foo is kept while php and ext-json are skipped. It fails before the change and passes after.

go test ./pkg/dependency/parser/php/composer/...
go test ./pkg/fanal/analyzer/language/php/composer/...