BUG: Packages being created with inadequate PURL data

This problem actually is associated with multiple AboutCode projects, but the impact is most apparent to the DejaCode user. A recent import of an SBOM to a product in DejaCode resulted in the creation of 3 different package definitions for `pkg:github/pypa/pip@20.3.1` each with a different download URL. A subsequent search for `pip@20.3.1` turned up 2 older package definitions for `pkg:pypi/pip@20.3.1` each with a different download URL. We don't have a problem of duplicate packages here, but the PURLs are not well defined and should contain additional details to differentiate them:

* The 2 pypi packages should have a file_name qualifier.
* The 3 github packages should have a subpath value.

Screenshot of the 5 pip@20.3.1 packages attached.