Rework how SCALIBR stores package metadata for packages extracted from SBOMs

[another-rex]

Rework how SCALIBR stores package metadata for packages extracted from SBOMs.

Currently functions like toEcosystem don't correctly parse the ecosystem if package is extracted from SBOMs