Support correct detailing of nested/bundled packages

We have several cases where built packages further embed other packages:
- pkg:npm/ajv@6.12.6 https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz embeds https://github.com/garycourt/uri-js/ in a webpacked bundle. There may be other packages in there
- JBoss Weld https://repo1.maven.org/maven2/org/jboss/weld/weld-osgi-bundle/ is an Uberjar mixing also JavaScript packages