package scan on the source/binary side for package manifests

Currently we are not scanning a lot of package manifests which we support and get package/dependencies for in the d2d pipeline.

Some examples are the:

- `.nuspec` and `.deps.json` files for nuget https://github.com/aboutcode-org/scancode.io/issues/1472
- `cartfile` and `cartfile.resolved` for macOS/iOS https://github.com/aboutcode-org/scancode-toolkit/issues/2656 https://github.com/aboutcode-org/scancode.io/issues/1471

This gives us better packages/dependencies information on these sources/binaries if we perform a package-scan on these.
This would be scanning all the resources which are not matched (scanning matched package manifests would introduce duplicates) .