Outdated, fixed vulnerabilities are still being reported for new Debian packages

Recently, `osv-scanner` has started reporting old, fixed vulnerabilities for new Debian packages.

Here is a quickly reproducible example using the `openssl` package from Debian 12:

```sh
$ osv-scanner --version
osv-scanner version: 1.9.2
commit: n/a
built at: n/a

$ cat >openssl.dpkg-status <
Installed-Size: 2351 kB
Depends: libc6 (>= 2.34), libssl3 (>= 3.0.9)
Suggests: ca-certificates
Filename: pool/main/o/openssl/openssl_3.0.15-1~deb12u1_amd64.deb
MD5sum: 7f636f8970fcd68823c24ec3c9c3bd00
SHA256: c9c37660d902f2a43dfbbf619b3f5f413cee298d8f317829e3c11cfff9e174aa
Homepage: https://www.openssl.org/
Tag: implemented-in::c, interface::commandline, protocol::ssl, role::program,
scope::utility, security::cryptography, security::integrity,
use::checking
Download-Size: 1427 kB
APT-Sources: http://deb.debian.org/debian bookworm/main amd64 Packages
Description: Secure Sockets Layer toolkit - cryptographic utility
EOF

$ osv-scanner -L dpkg-status:openssl.dpkg-status
Scanned /home/hezekiah/work/didactic/fp/navajo/openssl.dpkg-status file as a dpkg-status and found 1 package
╭────────────────────────────────┬──────┬───────────┬─────────┬──────────────────┬─────────────────────╮
│ OSV URL │ CVSS │ ECOSYSTEM │ PACKAGE │ VERSION │ SOURCE │
├────────────────────────────────┼──────┼───────────┼─────────┼──────────────────┼─────────────────────┤
│ https://osv.dev/CVE-2023-6129 │ 6.5 │ Debian │ openssl │ 3.0.15-1~deb12u1 │ openssl.dpkg-status │
│ https://osv.dev/CVE-2023-6237 │ │ Debian │ openssl │ 3.0.15-1~deb12u1 │ openssl.dpkg-status │
│ https://osv.dev/CVE-2024-0727 │ 5.5 │ Debian │ openssl │ 3.0.15-1~deb12u1 │ openssl.dpkg-status │
│ https://osv.dev/CVE-2024-13176 │ │ Debian │ openssl │ 3.0.15-1~deb12u1 │ openssl.dpkg-status │
│ https://osv.dev/CVE-2024-2511 │ │ Debian │ openssl │ 3.0.15-1~deb12u1 │ openssl.dpkg-status │
│ https://osv.dev/CVE-2024-4603 │ │ Debian │ openssl │ 3.0.15-1~deb12u1 │ openssl.dpkg-status │
│ https://osv.dev/CVE-2024-4741 │ │ Debian │ openssl │ 3.0.15-1~deb12u1 │ openssl.dpkg-status │
│ https://osv.dev/CVE-2024-5535 │ │ Debian │ openssl │ 3.0.15-1~deb12u1 │ openssl.dpkg-status │
│ https://osv.dev/CVE-2024-6119 │ │ Debian │ openssl │ 3.0.15-1~deb12u1 │ openssl.dpkg-status │
│ https://osv.dev/CVE-2024-9143 │ │ Debian │ openssl │ 3.0.15-1~deb12u1 │ openssl.dpkg-status │
╰────────────────────────────────┴──────┴───────────┴─────────┴──────────────────┴─────────────────────╯
```

Taking the first reported vulnerability, when looking up [CVE-2023-6129](https://osv.dev/vulnerability/CVE-2023-6129) it shows that under Debian 12 this vulnerability was fixed in version `3.0.13-1~deb12u1`. Since we are scanning on version `3.0.15-1~deb12u1` this vulnerability shouldn't apply. Yet it is still being reported.

Reproduce the report with the `openssl.dpkg-status` fixture and `osv-scanner -L dpkg-status:openssl.dpkg-status`, then trace how Debian package versions are matched against the OSV records for CVE-2023-6129. Compare the result with the listed fixed version `3.0.13-1~deb12u1`; done means fixed vulnerabilities are no longer reported for `3.0.15-1~deb12u1`.

Written by the indexing model from the issue text.