fix(osvmatcher): dedupe bulk queries

[rohan-patnaik]

Overview

This fixes duplicate package queries being sent in the same OSV bulk request.

Fixes #2654

Details

When the scan input contains the same package more than once, OSVMatcher currently sends that same package/version query multiple times to OSV. That does not change the final result, but it does add unnecessary API work and makes larger scans do more work than needed.

This PR deduplicates equivalent OSV queries before calling BatchQueryPaging, then expands the hydrated results back to the original package order. That keeps the scanner output behavior the same while reducing duplicate requests.

I also updated the cached matcher query collection to use the same query key, so it does not rely on pointer identity when collecting missing package queries.

Testing

• Added a regression test that passes duplicate package inputs and verifies only unique queries are sent while all original result slots are preserved.
• Ran go test ./internal/clients/clientimpl/osvmatcher.
• Ran go test ./internal/clients/clientimpl/....

Checklist

• I have signed the Contributor License Agreement.
• I have run the linter using ./scripts/run_lints.sh.
• I have run the unit tests using go test ./internal/clients/clientimpl/....
• I have made my commits and PR title follow the Conventional Commits specification.