Fix NilClass error in format_version_releases for Python package details fetcher

[kbukum1]

What are you trying to accomplish?

This PR fixes an issue where fetch_from_json_registry in PackageDetailsFetcher could return nil, leading to a Sorbet type validation error:

Dependabot::Sorbet::Runtime::InformationalError: Parameter 'releases_json': Expected type T::Hash[String, T::Array[T::Hash[String, T.untyped]]], got type NilClass

This error occurs when the registry response is unexpectedly empty or missing the releases key. The fix ensures that fetch_from_json_registry handles this case gracefully by providing a default empty hash ({}) if the response is nil.

What issues does this affect or fix?

Fixes:

• Dependabot::Sorbet::Runtime::InformationalError: Parameter 'releases_json': Expected type T::Hash[String, T::Array[T::Hash[String, T.untyped]]], got type NilClass #11788

---

Anything you want to highlight for special attention from reviewers?

• The fix ensures that even if fetch_from_json_registry returns nil, the method does not break due to unexpected NilClass values.
• Alternative solutions could involve handling this at a higher level, but this approach minimizes impact while fixing the issue directly at the source.

---

How will you know you've accomplished your goal?

• ✅ Successfully tested that fetch_from_json_registry no longer causes Sorbet type validation errors.
• ✅ Dependabot now properly processes package details even if releases_json is missing from the registry response.

---

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[abdulapopoola]

why make this nilable though?

[kbukum1]

The issue occurs because the JSON response from the registry does not include releases. The response body is either empty or contains unexpected data.

Normally, when releases information is missing from JSON, we fall back to the HTML registry, which is the standard process for Python dependencies. However, due to this Sorbet type validation error, the process fails before reaching the fallback. The root cause is that the releases parameter is being passed as nil, triggering a type mismatch in format_version_releases.

This fix ensures that when releases is missing or nil, we handle it gracefully without breaking the normal fallback mechanism.