fix: include package version in vulns lookup

[moshikod]

• Ready for review
• Follows CONTRIBUTING rules
• Reviewed by Snyk internal team

What does this PR do?

Fix the lookup for the associated Dockerfile instruction that introduced a package.
The lookup key should include both the package name and version and not just the package name.

How should this be manually tested?

Perform a test on an image which is a product of a Dockerfile such as:

FROM python:3.7-alpine3.8
RUN apk add --no-cache --update git=2.18.1-r0

Expect the git vulnerability to be introduced by instruction in the Dockerfile and not by the base image.

Screenshots

Before this fix, the git vulnerability was wrongly identified as Introduced by the base image

[orsagie]

LGTM. You need to close and reopen the PR to appveyor to restart

[snyksec]

🎉 This PR is included in version 1.234.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀