Are we identifying all affected Ubuntu packages?

While working on the SUSE Oval importer, I've been exploring the Debian and Ubuntu OVAL importers and noticed that in one set of test files, we are reporting `potrace` as an affected package but arguably should also report `libpotrace0` as an affected package.

I think the relevant `oval_parser.py` code is [here](https://github.com/nexB/vulnerablecode/blob/main/vulnerabilities/oval_parser.py#L103-L120). This function searches the `` element for a `var_ref` field and when found uses RegEx to extract the name of a package from the `comment` field.

With the test file [ubuntu_oval_data.xml](https://github.com/nexB/vulnerablecode/blob/main/vulnerabilities/tests/test_data/ubuntu_oval_data.xml), for example, it seems the term `potrace` is extracted from `comment="The 'potrace' package binaries."` on [line 83](https://github.com/nexB/vulnerablecode/blob/main/vulnerabilities/tests/test_data/ubuntu_oval_data.xml#L83).

However, in the `` element [below](https://github.com/nexB/vulnerablecode/blob/main/vulnerabilities/tests/test_data/ubuntu_oval_data.xml#L97-L106), there is not only a similar `comment` field, but two nested `` elements, one with the text `libpotrace0` and the other with the text `potrace`. I suspect that we actually want to report both of these as affected packages, but current report only `potrace` (see [ubuntu-oval-expected.json](https://github.com/nexB/vulnerablecode/blob/main/vulnerabilities/tests/test_data/ubuntu-oval-expected.json#L12)).

BTW, based on minor sampling thus far, it appears that neither Debian nor SUSE includes a `` element in their respective OVAL XML structures.