fix(cargo-lock): normalize everything for git-ref in deps

[weihanglo]

Fixes #1296

See #1296 (comment).

4554f1e shows that the current implementation covers git branches, and 7e5bdf5 serves as a minimal reproducible example showing it fails on git tags.

[weihanglo]

This also fails on main branch c460e54

---- happy_path stdout ----
thread 'happy_path' panicked at rustsec/tests/integration.rs:58:5:
assertion `left == right` failed
  left: Some(Vulnerability { advisory: Metadata { id: Id { kind: RustSec, year: Some(2024), string: "RUSTSEC-2024-0402" }, package: Name("hashbrown"), title: "Borsh serialization of HashMap is non-canonical", description: "The borsh serialization of the HashMap did not follow the borsh specification.\nIt potentially produced non-canonical encodings dependent on insertion order.\nIt also did not perform canonicty checks on decoding.\n\nThis can result in consensus splits and cause equivalent objects to be\nconsidered distinct.\n\nThis was patched in 0.15.1.", date: Date("2024-10-11"), aliases: [], related: [], collection: Some(Crates), categories: [], keywords: [Keyword("borsh")], cvss: None, informational: None, references: [], source: None, url: Some(Url { scheme: "https", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("github.com")), port: None, path: "/rust-lang/hashbrown/issues/576", query: None, fragment: None }), withdrawn: None, license: CcZero10 }, versions: Versions { patched: [VersionReq { comparators: [Comparator { op: GreaterEq, major: 0, minor: Some(15), patch: Some(1), pre: Prerelease("") }] }], unaffected: [VersionReq { comparators: [Comparator { op: Less, major: 0, minor: Some(15), patch: Some(0), pre: Prerelease("") }] }] }, affected: Some(Affected { arch: [], os: [], functions: {FunctionPath([Identifier("hashbrown"), Identifier("HashMap"), Identifier("borsh_serialize")]): [VersionReq { comparators: [Comparator { op: Exact, major: 0, minor: Some(15), patch: Some(0), pre: Prerelease("") }] }]} }), package: Package { name: Name("hashbrown"), version: Version { major: 0, minor: 15, patch: 0 }, source: Some(SourceId { url: Url { scheme: "https", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("github.com")), port: None, path: "/rust-lang/crates.io-index", query: None, fragment: None }, kind: Registry, precise: Some("locked"), name: None }), checksum: Some(Sha256(1e087f84d4f86bf4b218b927129862374b72199ae7d8657835f1e[89](https://github.com/rustsec/rustsec/actions/runs/12224142095/job/34096527733?pr=1298#step:7:90)000eea4fb)), dependencies: [], replace: None } })
 right: None

[tarcieri]

@weihanglo I think that's unrelated. I can attempt a fix