Convert `aliases` with multiple of same prefix to use `upstream`

Under the definition of the `aliases` field, is it correct to say that records listed in it should never be from the same data source/prefix? (and ideally they should also have the same purls, if they both have purls).

However, there exist a lot of records in osv.dev that have multiple of the same prefix in the `aliases` field.

As far as I'm aware, this isn't due to any record's _original_ `aliases` list including records from the same source as it is (as that wouldn't make much sense for a record to alias something from the same source, when the source could just update their one record). But it _can_ end up this way, after the alias set computation that osv.dev does at ingestion.

So from what I've seen, it can be down to one of the 2 things listed below (although I found it hard to confirm due to the subsequent alias computation). These are simply due to records still using the `aliases` field, instead of the newer `upstream` field where it should be used.

Records' _original_ `aliases` data that would need to be changed:
1. Records that alias to multiple of the same prefix e.g. CVEs -> These CVEs should be placed in `upstream` instead.
* This can cause a problem if other records (correctly) use these individual CVEs as aliases. As after the alias computation occurs, it results in wrong/lost information. e.g. A record that previously aliased to one CVE, will then be incorrectly aliased to multiple CVEs. Therefore, the information about which CVE it actually aliases to is lost. An example of this is this RUSTSEC record that aliases multiple CVEs, affecting the GHSA records that map to the CVEs indvidually: https://osv.dev/vulnerability/RUSTSEC-2020-0014.
2. Records from the same source (for different purls) that put the same CVE as an alias -> This doesn't cause as much of an issue, although it's still an incorrect use of `aliases`. (Although a similar issue to the above could happen if there's another record that's supposed to only alias to one of them - but that's not something I've found an example of - I've only seen it to be a problem when multiple CVEs are aliased together, as described in no. 1)
* This could be worked out by looking at the ecosystems using `aliases` for CVEs that probably should be using `upstream` instead. e.g. Bitnami: https://osv.dev/vulnerability/BIT-libpython-2025-13836