Support parsing commits from manifests

#94 adds support for using the `osv.dev` API which supports commits as well as versions - so we should make sure the manifest parsers are able to extract this information from their respective files as much as possible.

(This is mostly a place for me to dump info I find during research)

* [ ] `cargo.lock`
* [x] `package-lock.json`
* [x] `yarn.lock`
* [x] `pnpm-lock.yaml`
* [x] `composer.lock`
* [x] `Gemfile.lock`
* [ ] `go.mod`
* [ ] `pom.xml`
* [ ] `requirements.txt`