[New Feature]: Warn if ARP Data is similar between different packages

Description of the new feature/enhancement

The feature request comes as a consequence of https://github.com/microsoft/winget-pkgs/issues/95155 where users of an official package got upgraded to a third-party repackaged software that made unwanted changes to their current installation.

The reason was that both the official and the repackaged version shared the same PackageName, Publisher and even ProductCode (as it was an exe based installer where unique ProductCodes are not guaranteed). These fields are the primary ones for upgrade matching in case of an exe installer.

Proposed technical implementation details (optional)

Pipelines should compare the ARP fields between different PackageIdentifiers (fuzzy match for PackageName, exact match for ProductCode and Publisher) in addition to comparing the SHA-256 hash. Similar to an SHA-256 collision, a Possible-Duplicate label calling for manual review can be added upon detecting a duplicate with an existing PackageIdentifier.

Start by locating the pipelines responsible for comparing package metadata and SHA-256 hashes; no files or tests are named in the issue. Read how PackageName, Publisher, ProductCode, and PackageIdentifiers are currently handled, then define completion as detecting likely cross-package duplicates and routing them for manual review without disrupting existing matching.