Remove the entry from composer.json then run composer update phpmd/phpmd.
As to why that is the solution that works. I have no idea but that is what is required to remove a package totally from composer.lock and /vendor and allow you to install a new/replacement/conflicting package.