Unclear why tagging is necessary in twiddledum solution

[jasonculligan]

https://github.com/cider-security-research/cicd-goat/blame/01cd2a4b317fb5d2327435f432c691162a136c73/solutions/twiddledum.md#L11

Reading the solution for twiddledum, it doesn't explain why tagging is necessary for the exploit to work. The requirement to tag should be made more clear.

[kairat1115]

Hi @jasonculligan, that is how package.json references to dependency with git url https://docs.npmjs.com/cli/v9/configuring-npm/package-json#git-urls-as-dependencies

If the commit-ish has the format #semver:, can be any valid semver range or exact version, and npm will look for any tags or refs matching that range in the remote repository, much as it would for a registry dependency

[TupleType]

Hey @jasonculligan,
Great point, could you create a PR with the proposed changes?