Improve summary and classify plugins

We not tagging key files correctly in cases where they are not present at the root, and so in these cases we are not calculating the summary and license clarity score correctly.

Consider the following example package:

https://download.opensuse.org/source/distribution/leap/15.6/repo/oss/src/apache-commons-lang-2.6-12.26.src.rpm

If we scan this package after extracting with:
```
scancode -clpieu --license-text --license-diagnostics --license-text-diagnostics --license-references apache-commons-lang-2.6-12.26.src/ --classify --summary --json-pp apache-commons-lang-2.6-12.26.src.json -n 8
```
We have the following scan result:
[apache-commons-lang-2.6-12.26.src.json](https://github.com/user-attachments/files/16108931/apache-commons-lang-2.6-12.26.src.json)

Where the summary license clarity score is not correct:
```
"summary": {
"declared_license_expression": "apache-2.0",
"license_clarity_score": {
"score": 0,
"declared_license": false,
"identification_precision": false,
"has_license_text": false,
"declared_copyrights": false,
"conflicting_license_categories": true,
"ambiguous_compound_licensing": true
},
"declared_holder": "",
"primary_language": "Java",
```
and the NOTICE.txt is not detected as a key file:
```
{
"path": "apache-commons-lang-2.6-12.26.src/commons-lang-2.6-src/NOTICE.txt",
"type": "file",
"name": "NOTICE.txt",
"base_name": "NOTICE",
"extension": ".txt",
"size": 178,
"date": "2011-01-13",
"sha1": "177725905c21e318b07655c6d4e73b7fa2322e5b",
"md5": "3b6d793e3be40ed0f004caae43d4fad5",
"sha256": "6f75cf3152b2f503cc0627b9d24342da6ac65766cee18d17eb927f15108d7ad7",
"mime_type": "text/plain",
"file_type": "ASCII text, with CRLF line terminators",
"programming_language": null,
"is_binary": false,
"is_text": true,
"is_archive": false,
"is_media": false,
"is_source": false,
"is_script": false,
"package_data": [],
"for_packages": [
"pkg:maven/commons-lang/commons-lang@2.6?uuid=78e7446e-7b76-44c9-9db5-5090a600cf9e"
],
"is_legal": true,
"is_manifest": false,
"is_readme": false,
"is_top_level": false,
"is_key_file": false,
```

But when we scan the `commons-lang-2.6-12.26` archive inside with:

```
scancode -clpieu --license-text --license-diagnostics --license-text-diagnostics --license-references apache-commons-lang-2.6-12.26.src/commons-lang-2.6-src/ --classify --summary --json-pp commons-lang-2.6-12.26.src.json -n 8
```

we do get a correct summary:
```
"summary": {
"declared_license_expression": "apache-2.0",
"license_clarity_score": {
"score": 100,
"declared_license": true,
"identification_precision": true,
"has_license_text": true,
"declared_copyrights": true,
"conflicting_license_categories": false,
"ambiguous_compound_licensing": false
},
"declared_holder": "The Apache Software Foundation",
"primary_language": "Java",
```
and the NOTICE.txt file is also detected correctly as a key file:

```
{
"path": "commons-lang-2.6-src/NOTICE.txt",
"type": "file",
"name": "NOTICE.txt",
"base_name": "NOTICE",
"extension": ".txt",
"size": 178,
"date": "2011-01-13",
"sha1": "177725905c21e318b07655c6d4e73b7fa2322e5b",
"md5": "3b6d793e3be40ed0f004caae43d4fad5",
"sha256": "6f75cf3152b2f503cc0627b9d24342da6ac65766cee18d17eb927f15108d7ad7",
"mime_type": "text/plain",
"file_type": "ASCII text, with CRLF line terminators",
"programming_language": null,
"is_binary": false,
"is_text": true,
"is_archive": false,
"is_media": false,
"is_source": false,
"is_script": false,
"package_data": [],
"for_packages": [
"pkg:maven/commons-lang/commons-lang@2.6?uuid=889000e4-63a3-4613-b301-6193532099de"
],
"is_legal": true,
"is_manifest": false,
"is_readme": false,
"is_top_level": true,
"is_key_file": true,
```

We should make sure we detect and tag key files present in other places correctly by implementing `get_key_files()` functions for all package ecosystems and tag these for all packages present inside a package, so we don't miss these.