Track "successor" package [was: Incorrect Package data]

Some of the data we have in the database for Package versions is incorrect. Examples include:

- `pkg:maven/log4j/log4j@2.17.0`
- As I understand the namespace transition, the 1.x versions used the `log4j` namespace, e.g., `pkg:maven/log4j/log4j@1.2`, while the 2.x versions use the `org.apache.logging.log4j` namespace, e.g., `pkg:maven/org.apache.logging.log4j/log4j@2.0`.
- See, e.g., https://repo1.maven.org/maven2/log4j/log4j/, which lists a number of 1.x versions but no 2.x versions.
- See also [this related issue](https://github.com/nexB/vulnerablecode/issues/1284).

- `pkg:maven/org.apache.tomcat/tomcat@76.0.77`
- It appears that the latest versions of `org.apache.tomcat/tomcat` do not come close to reaching 76.0.x. See, e.g., https://tomcat.apache.org/ and https://mvnrepository.com/artifact/org.apache.tomcat/tomcat