--only-findings doesn't filter out uninteresting files in --package mode

### Description

When using --only-findings together with --package, the only-findings filtering doesn't take effect since the for_packages attribute is always set. This rather defeats the purpose and leads to output files that are 100s of times bigger than really needed.

I suggest that https://github.com/nexB/scancode-toolkit/blob/develop/src/scancode/plugin_only_findings.py needs an exception to ignore for_packages

### How To Reproduce

e.g. `scancode --package --copyright --license --license-text --only-findings --classify --summary --tallies --license-clarity-score --json-pp=scancode-package-and-only-findings.json PATH`

where PATH could be extracted from something like `https://repo1.maven.org/maven2/log4j/log4j/1.2.17/log4j-1.2.17.jar`

The resulting json is about 10,000 lines (instead of 1000 you'd get without the packages option) due to uninformative items like:

```
{
"path": "log4j-1.2.17.jar-extract/org/apache/log4j/Appender.class",
"type": "file",
"package_data": [],
"for_packages": [
"pkg:maven/log4j/log4j@1.2.17?uuid=03c476c1-0273-4156-ba39-639b19b337c5"
],
"is_legal": false,
"is_manifest": false,
"is_readme": false,
"is_top_level": false,
"is_key_file": false,
"detected_license_expression": null,
"detected_license_expression_spdx": null,
"license_detections": [],
"license_clues": [],
"percentage_of_license_text": 0,
"copyrights": [],
"holders": [],
"authors": [],
"scan_errors": []
},
```
### System configuration

* Linux
* scancode-toolkit v 32.0.8
* Installed using pip