Handle repositories that only give provider information #48

As a user of asset-packagist.org, I want to be able to use libyear, so that I can keep my back-end managed front-end dependencies up-to-date.

Acceptance criteria:

• a composer.json file referencing the repository at https://asset-packagist.org with dev dependency on npm-asset/xunit.ts @ v1.4.0 shows the correct information for that package