Consider tracking new SCTK v32.x top-level license packages rather than file-level package_data

In the latest ScanCode toolkit v32 (upgraded here with #715 ) we now have a list of top level packages that are formed from the combination of several "data files" and exists separately of the previous "package_data" at the file level. It would be useful to consider using these instead of the file-level package data. We also need to track each separate package instances reported there, as there can be more than one copy of a package present in the codebase.