Map and match does not work as expected for Java

I am running a `deploy_to_develop` pipeline using the sources and binaries of https://github.com/RomanIakovlev/timeshape
Specially I used these Maven JARs (attached for reference):
- wrapped in a to-timeshape.zip : https://repo1.maven.org/maven2/net/iakovlev/timeshape/2023b.18/timeshape-2023b.18.jar
- wrapped in a from-timeshape.zip : https://repo1.maven.org/maven2/net/iakovlev/timeshape/2023b.18/timeshape-2023b.18-sources.jar

As it happens the PurlDB I am using has these indexed for matching.

I was expecting the the big `data.tar.zstd` in the binary JAR to be reported as not mapped to sources. But it happens it is only reported as matched upstream to https://repo1.maven.org/maven2/net/iakovlev/timeshape/2023b.18/timeshape-2023b.18.jar which does not help because while the binary and source JARs do not have much of license documentation inside, the POM at https://repo1.maven.org/maven2/net/iakovlev/timeshape/2023b.18/timeshape-2023b.18.pom is only MIT and does not report the license of the embedded OpenStreet map data ... The provenance is only documented in the upstream repo at https://github.com/RomanIakovlev/timeshape/blob/master/DATA_LICENSE
It would have been mighty useful to report the data tarball as missing from sources .

I would like to always map and match somehow. And report the parts not mapped as possible issues... but not for bundled dependencies. So this may require some extra design and thinking.

[from-timeshape.zip](https://github.com/nexB/scancode.io/files/12859093/from-timeshape.zip)
[to-timeshape.zip](https://github.com/nexB/scancode.io/files/12859094/to-timeshape.zip)