Package sets can have unrelated packages

[JonoYang]

I was running the collect endpoint on an npm package inherits 2.0.0 and it returned package data that included pkg:github/substack/node-browserify@2.0.0 as the source repo of inherits. This is an issue and I think a good place to start is the purl2vcs code that we call

[Monal-Reddy]

I have reproduced the issue using django shell to check if it still exits, also checked the commit history of purl2vcs to get an idea of whether description scanning idea was intentionally added
what i have understood is that

1. if a url has 'github' you assume it is a repo but u dont check if the repo name matches the actual package name
2. then when the URLs are converted to PURL and the version tags match, it is assumed to be a source repo and added to the package set
3. Because the algorithm was designed to recover missing repo metadata it intentionally scans homepage, description, resources But without validation, this becomes too permissive.

[Monal-Reddy]

one problem is that we cant strictly enforce repo name is exactly equal to package name
@JonoYang i have added a fix for this , please review when time