install/deps: Let git deps w/ lock only match package.json

Previously they would only match if the complete commitid was used.  This
allows partial matching when no on-disk component is available.

Fixes: #16839

PR-URL: #20390
Credit: @iarna
Reviewed-By: @zkat

lib/install/deps.js

@@ -51,6 +51,16 @@ function doesChildVersionMatch (child, requested, requestor) {
     return path.relative(child.realpath, requested.fetchSpec) === ''
   }
 
+  if (requested.type === 'git' && child.fromShrinkwrap) {
+    const fromSw = child.fromShrinkwrap
+
+    if (fromSw.rawSpec === requested.rawSpec) return true
+
+    if (!fromSw.hosted || !requested.hosted) return false
+
+    return fromSw.hosted.toString() === requested.hosted.toString()
+  }
+
   if (!registryTypes[requested.type]) {
     var childReq = child.package._requested
     if (childReq) {

lib/install/inflate-shrinkwrap.js

@@ -78,7 +78,7 @@ function inflatableChild (onDiskChild, name, topPath, tree, sw, requested, opts)
   const modernLink = requested.type === 'directory' && !sw.from
   if (hasModernMeta(onDiskChild) && childIsEquivalent(sw, requested, onDiskChild)) {
     // The version on disk matches the shrinkwrap entry.
-    if (!onDiskChild.fromShrinkwrap) onDiskChild.fromShrinkwrap = true
+    if (!onDiskChild.fromShrinkwrap) onDiskChild.fromShrinkwrap = requested
     onDiskChild.package._requested = requested
     onDiskChild.package._spec = requested.rawSpec
     onDiskChild.package._where = topPath