Handle repositories that only give provider information

[SteveDesmond-ca]

As a user of asset-packagist.org, I want to be able to use libyear, so that I can keep my back-end managed front-end dependencies up-to-date.

Acceptance criteria:

• a composer.json file referencing the repository at https://asset-packagist.org with dev dependency on npm-asset/xunit.ts @ v1.4.0 shows the correct information for that package

[SteveDesmond-ca]

With Drupal having switched to packagist, this is now much lower priority, and unlikely to be completed without a sponsor.