fix: use commit query for npm packages resolved from git URLs

[johnsaurabh]

Overview

Fixes #2850

pkgToQuery queried OSV.dev by npm ecosystem+name for all npm-ecosystem packages, including those resolved from git URLs in yarn.lock. These packages were never published to the npm registry, so the query returns false positives from unrelated packages that share the same name on npm.

Details

The yarnlock extractor already populates SourceCode.Commit for git-pinned dependencies via commitextractor.TryExtractCommit. When a commit hash is present for an npm-ecosystem package, pkgToQuery now returns a commit query instead of an ecosystem query.

```go
if imodels.Commit(pkg) != "" && imodels.Ecosystem(pkg).Ecosystem == osvconstants.EcosystemNPM {
return &api.Query{
Param: &api.Query_Commit{
Commit: imodels.Commit(pkg),
},
}
}
```

The gate is specific to npm. Other ecosystems are unaffected.

Testing

• Added `TestPkgToQuery` with two cases: a regular npm package (uses ecosystem query) and a git-pinned npm package (uses commit query).
• Tested against the `closure-net` entry from the issue. Without the fix it reports `MAL-2026-276` as a false positive. With the fix, no vulnerabilities are reported.
• All existing tests pass.

Checklist

• I have signed the Contributor License Agreement.
• I have run the linter using `./scripts/run_lints.sh`.
• I have run the unit tests using `./scripts/run_tests.sh`.
• I have made my commits and PR title follow the Conventional Commits specification.