feat(composer): support providers without a hash

[herndlm]

Changes:

We're using a Nexus repository with the Composer plugin installed and I noticed that querying packages.json returns this

{
  "providers-url": "https://host/repository/repo-name/p/%package%.json",
  "providers": {
    "foo/bar": {
      "sha256": null
    }
  }
}

which was not supported yet because the packagist datasource assumes that a hash is always set.

I did not find specs yet but asked at composer/composer#10337. Irrelevant of the outcome though I think this should be supported as Composer updates are working perfectly fine.

Context:

Might close #10649

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please tick one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests but ran on a real repository, or
• Both unit tests + ran on a real repository

[renovate-release]

🎉 This PR is included in version 29.34.0 🎉

The release is available on:

• GitHub release
• 29.34.0

Your semantic-release bot 📦🚀

[herndlm]

Fyi got an answer to my question:

It's not an ideal repository implementation if it doesn't have hashes as it forbids caching, plus it is Composer v1 format and not the faster Composer v2 one, but technically null values there are supported by Composer.