In case Arch and pypi both had the package we would prefer Arch.
While that helps in case Arch tries to keep older versions to keep
everything compatible, there are cases where things are outdated
in Arch and updates happend despite being in conflict,
so in reality we need to check ourselves anyway.
The "name" of the sbom components no longer contain the pkgbase
we can use to map vulns. Instead components now have one ore more
properties with the key "msys2:pkgbase" and the value being the pkgbase.
