fix(vulnfeeds): group affected versions by package and ecosystem

[jess-lowe]

fix #3385 Alpine CVE converter creating duplicate entries

Groups affected version and commit information by package and ecosystem, preventing duplicate affected entries in OSV exports.

Details

• Modified AddPkgInfo to look for existing Affected entries matching the package name and ecosystem before creating a new one.
• Merges events into a single Range object per type (ECOSYSTEM, GIT) within that entry, rather than creating multiple ranges of the same type.
• Resolves duplicate entries and inconsistent exports seen in the Alpine converter (and potentially others).
• Added unit tests (TestAddPkgInfo_MergeAffected) to verify merging logic.