fix: edge case with packagist versioning (#4717)

Caught this failure on the coarse version fuzzing test.
Packagist versions collapse repeated separators into one.

Author: michaelkedar

osv/ecosystems/coarse_version_monotonicity_test.py

@@ -143,6 +143,7 @@ def test_nuget(self, v1_str, v2_str):
     check_coarse_version_monotonic(self, nuget.NuGet(), v1_str, v2_str)
 
   @given(packagist_version_strategy, packagist_version_strategy)
+  @example('0__1', '00')
   def test_packagist(self, v1_str, v2_str):
     check_coarse_version_monotonic(self, packagist.Packagist(), v1_str, v2_str)
 

osv/ecosystems/packagist.py

@@ -147,7 +147,7 @@ def php_canonicalize_version(version: str) -> str:
     """
     if version.startswith('v'):
       version = version[1:]
-    replaced = re.sub('[-_+]', '.', version)
+    replaced = re.sub('[-_+.]+', '.', version)
     replaced = re.sub(r'([^\d.])(\d)', r'\1.\2', replaced)
     replaced = re.sub(r'(\d)([^\d.])', r'\1.\2', replaced)
     return replaced