Poetry detector fails on specific use case due to multiple sources for a package being specified in poetry.lock file

If a lock file is generated that has multiple source entries under a single package, the poetry detector will hard fail:

Tomlyn.TomlException: (157,1) : error : The key `package.[3].source` is already defined at (152,1) with `[package.source]␤type = \"legacy\"␤url = \"https://artifactory.metaswitch.com/api/pypi/pypi-virtual/simple\"␤reference = \"metaswitch\"` and cannot be redefined
(160,1) : error : The key `package.[3].source.reference` is already defined at (155,1) with `reference = \"metaswitch\"` and cannot be redefined
(162,1) : error : The key `package.[3].source` is already defined at (152,1) with `[package.source]␤type = \"legacy\"␤url = \"https://artifactory.metaswitch.com/api/pypi/pypi-virtual/simple\"␤reference = \"metaswitch\"` and cannot be redefined
(165,1) : error : The key `package.[3].source.reference` is already defined at (155,1) with `reference = \"metaswitch\"` and cannot be redefined
(215,1) : error : The key `package.[5].source` is already defined at (210,1) with `[package.source]␤type = \"legacy\"␤url = \"https://artifactory.metaswitch.com/api/pypi/pypi-virtual/simple\"␤reference = \"metaswitch\"` and cannot be redefined
(218,1) : error : The key `package.[5].source.reference` is already defined at (213,1) with `reference = \"metaswitch\"` and cannot be redefined
(220,1) : error : The key `package.[5].source` is already defined at (210,1) with `[package.source]␤type = \"legacy\"␤url = \"https://artifactory.metaswitch.com/api/pypi/pypi-virtual/simple\"␤reference = \"metaswitch\"` and cannot be redefined
(223,1) : error : The key `package.[5].source.reference` is already defined at (213,1) with `reference = \"metaswitch\"` and cannot be redefined
at Tomlyn.Toml.ToModel[T](String text, String sourcePath, TomlModelOptions options)
at Microsoft.ComponentDetection.Detectors.Poetry.PoetryComponentDetector.OnFileFoundAsync(ProcessRequest processRequest, IDictionary`2 detectorArgs, CancellationToken cancellationToken)
at Microsoft.ComponentDetection.Contracts.FileComponentDetector.OnFileFoundAsync(ProcessRequest processRequest, IDictionary`2 detectorArgs, Boolean cleanupCreatedFiles, CancellationToken cancellationToken)
at Microsoft.ComponentDetection.Contracts.FileComponentDetector.<>c__DisplayClass57_0.<<ProcessAsync>b__0>d.MoveNext()

spec for lock file needs to be reviewed and contract updated to prevent this.

Start at PoetryComponentDetector.OnFileFoundAsync and reproduce the reported poetry.lock case with multiple source entries for one package. Review the lock-file specification and contract, then confirm the detector no longer hard-fails and that the contract covers this structure.