The "name" of the sbom components no longer contain the pkgbase we can use to map vulns. Instead components now have one ore more properties with the key "msys2:pkgbase" and the value being the pkgbase.