Assignment of Download URL to a detected package needs to be improved

A recent scan (using ScanCode.io) of vscode-1.33.1.tar.gz (from https://github.com/microsoft/vscode/archive/1.33.1.tar.gz ) resulted in the assignment of invalid Download URL's to detected packages. An example is the detected package `clojure-1.0.0.tgz` which was assigned a Download URL of `https://registry.npmjs.org/clojure/-/clojure-1.0.0.tgz` which does not work.

An archive of the scan output is attached.

[vscode-1.33.1.tar.gz_scan.json.zip](https://github.com/nexB/scancode-toolkit/files/3173826/vscode-1.33.1.tar.gz_scan.json.zip)