Deal with multiple sha1 matches

Determine whether or not a match is a primary or secondary

How to handle multiple sha1 matches on JARs? How do we determine what is the best?

- sha1 match
- if there is more than 1 result, then find the result with the same file name
- if there is no exact name match, we perform a fuzzy match on the name

During index time, what should we do when we have multiple versions of a package with the same file.
- We determine that the best match would be to the oldest package because its the oldest and the first package
- We need to populate release_date when creating packages
- look at dir scraping code
- If we cant pick one, sort by purl and pick the first one