Do not include @ when no ref is specified

[matteius]

Solves some edge cases:

• vcs sub-requirement has no ref
• old Pipfile or Pipfile.lock that contains a ref in the vcs url.

The issue

Fixes #5843
Fixes #5846

The checklist

• Associated issue
• A news fragment in the news/ directory to describe this fix with the extension .bugfix.rst, .feature.rst, .behavior.rst, .doc.rst. .vendor.rst. or .trivial.rst (this will appear in the release changelog). Use semantic line breaks and name the file after the issue number or the PR #.