Do not double scan a file both as a package and as a plain file

This leads to confusing reporting.
We should scan first for package and skip scanning as a file when the package manifest is scanned properly.

Though we need to make sure that we do not skip or ignore rare cases such as some Maven POM that use XML comments for their license notice as opposed to use structure license fields.

https://repo1.maven.org/maven2/org/glassfish/javax.json/1.1.4/javax.json-1.1.4.pom