ComposerInspector should account for the way `composer show` displays versions of packages installed from dev snapshots, to avoid angering Semver::satisfies()

Problem/Motivation

After #3345607: Update to Package Manager 3.x landed i wanted to give it a try. problem is after installing project browser dev and automatic updated 3.x dev i run into a wsod when i try to access /admin/modules/browse . the error is:

The website encountered an unexpected error. Please try again later.

UnexpectedValueException: Invalid version string "10.1.x-dev a5c48d0" in Composer\Semver\VersionParser->normalize() (line 186 of /var/www/html/vendor/composer/semver/src/VersionParser.php).
Composer\Semver\Semver::satisfies('10.1.x-dev a5c48d0', '*') (Line: 202)
Drupal\package_manager\Validator\ComposerPluginsValidator->Drupal\package_manager\Validator\{closure}('10.1.x-dev a5c48d0', 'drupal/core-composer-scaffold')
array_filter(Array, Object, 1) (Line: 200)
Drupal\package_manager\Validator\ComposerPluginsValidator->validate(Object, 'Drupal\package_manager\Event\StatusCheckEvent', Object)
call_user_func(Array, Object, 'Drupal\package_manager\Event\StatusCheckEvent', Object) (Line: 111)
Drupal\Component\EventDispatcher\ContainerAwareEventDispatcher->dispatch(Object) (Line: 52)
Drupal\project_browser\InstallReadiness->runStatusCheck(Object, Object) (Line: 50)
Drupal\project_browser\InstallReadiness->validatePackageManager() (Line: 162)
Drupal\project_browser\Controller\BrowserController->browse('')
call_user_func_array(Array, Array) (Line: 123)
Drupal\Core\EventSubscriber\EarlyRenderingControllerWrapperSubscriber->Drupal\Core\EventSubscriber\{closure}() (Line: 583)
Drupal\Core\Render\Renderer->executeInRenderContext(Object, Object) (Line: 121)
Drupal\Core\EventSubscriber\EarlyRenderingControllerWrapperSubscriber->wrapControllerExecutionInRenderContext(Array, Array) (Line: 97)
Drupal\Core\EventSubscriber\EarlyRenderingControllerWrapperSubscriber->Drupal\Core\EventSubscriber\{closure}() (Line: 163)
Symfony\Component\HttpKernel\HttpKernel->handleRaw(Object, 1) (Line: 74)
Symfony\Component\HttpKernel\HttpKernel->handle(Object, 1, 1) (Line: 58)
Drupal\Core\StackMiddleware\Session->handle(Object, 1, 1) (Line: 48)
Drupal\Core\StackMiddleware\KernelPreHandle->handle(Object, 1, 1) (Line: 106)
Drupal\page_cache\StackMiddleware\PageCache->pass(Object, 1, 1) (Line: 85)
Drupal\page_cache\StackMiddleware\PageCache->handle(Object, 1, 1) (Line: 48)
Drupal\Core\StackMiddleware\ReverseProxyMiddleware->handle(Object, 1, 1) (Line: 51)
Drupal\Core\StackMiddleware\NegotiationMiddleware->handle(Object, 1, 1) (Line: 51)
Drupal\Core\StackMiddleware\StackedHttpKernel->handle(Object, 1, 1) (Line: 698)
Drupal\Core\DrupalKernel->handle(Object) (Line: 19)

Steps to reproduce

1. Spin up a new drupal 10.1x-dev site with composer create "drupal/recommended-project:10.1.x-dev@dev" (running on ddev with php 8.2 and mariadb 10.5)
2. composer require 'drupal/project_browser:1.0.x-dev@dev'
3. composer require 'drupal/automatic_updates:3.0.x-dev@dev'
4. Install project browser and package manager on /admin/modules
5. on /admin/config/development/project_browser check allow installing ui (experimental)
6. go to /admin/modules/browse
7. the error happens

Proposed resolution

ComposerInspector::getInstalledPackagesList() should account for this. If it detects a -dev in a package's version, it should remove the commit hash, since it won't be needed for our purposes.

Composer's decision to display dev snapshot versions as BRANCH-dev HASH is intentional; it's what BasePackage::getFullPrettyVersion() does. This is not something we need to change upstream; it's just an oversight on our part. We never encountered it before because it is only done for packages that are installed from git or hg repositories (we develop on a core dev snapshot, but it is installed via a path repo, so composer show reports its version as, simply, 10.1.x-dev).

Remaining tasks

• ✅ File an issue about this project
• ☐ Manual Testing
• ☐ Code Review
• ☐ Accessibility Review
• ☐ Automated tests needed/written?