Wrong dump data for Debian packages

Not sure if this should go here or another repository, so feel free to move.

I just looked at `deb-purls-aa.json.zst` and saw this line:

```
{"purl":"pkg:deb/0ad@0.0.23.1-4","download_url":"http://ftp.debian.org/debian/pool/main/0/0ad/0ad_0.0.23.1.orig.tar.xz"}
```

The package number and the referenced source code file do *not* match: the file in `download_url` is the *original* file and is actually the same for multiple patch versions. The version number only becomes `-4` *after* applying the Debian specific patches, so these should probably also be included. The patches for `-4` are no longer available via the Debian FTP, but for `-5` they are.

The `.dsc` file for `-5` says:

```
Files:
4fa111410ea55de7a013406ac1013668 31922812 0ad_0.0.23.1.orig.tar.xz
43a5bf77192a8eebdbe763cdd1d72fa3 73620 0ad_0.0.23.1-5.debian.tar.xz
```

So possibly you should not have this as a single download URL, but as a *list* of download URLs.

Also, with Debian these URLs tend to get moved (granted, after many years) to their archive. It might be good to take a closer look at https://github.com/nexB/fetchcode/issues/82