Consider adding mapping to the Package class for related Packages

Some Packages have changed their namespace over time. One example is `pkg:maven/log4j/log4j@1.2`, where (if I understand the progression) the 2.x versions have a different namespace, e.g., `pkg:maven/org.apache.logging.log4j/log4j@2.0`. (I think [this GitHub repo](https://github.com/apache/logging-log4j1) is related to this relationship.)

It would be useful to create a mapping for these Packages, perhaps in the `Package` class, so that a query for the fixed versions of a potentially affected `Package` will return all relevant namespaces for that `Package`.