How do I convert a Drush make commit-level dependency into Composer?
The location you're defining it at is wrong. When defining your own packages, the version tag is used to target branches or tags. If you want specify a commit-level project requirement, do it in require object where you're specifying your requirement in the  dev-${BRANCH}#${COMMIT_HASH} format.

In repositories:

{
  "type": "package",
  "package": {
    "name": "hybridauth/hybridauth",
    "version": "master",
    "type": "drupal-library",
    "source": {
      "url": "https://github.com/hybridauth/hybridauth",
      "type": "git",
      "reference": "master"
    }
  }


In require:

"hybridauth/hybridauth": "dev-master#38f0735",