#94 adds support for using the osv.dev API which supports commits as well as versions - so we should make sure the manifest parsers are able to extract this information from their respective files as much as possible.

(This is mostly a place for me to dump info I find during research)

• cargo.lock
• package-lock.json
• yarn.lock
• pnpm-lock.yaml
• composer.lock
• Gemfile.lock
• go.mod
• pom.xml
• requirements.txt