feat(advisories): NPM Git-based dependencies should report when using branches / tags instead of commit hashes