Update scancode.io models to handle new scancode-toolkit scan fields

[JonoYang]

In a scancode JSON output, all Packages detected in a scan are present in a top-level attribute named packages. Likewise, all detected Dependencies are placed in the dependencies attribute. Multiple copies of the same package can be present in the packages field, if a particular package was detected multiple times in the same codebase. Each copy of this package will have a different package_uid. A package_uid is the purl of that package with a qualifier named uuid that is specific to the scancode run. e.g. pkg:pypi/[email protected]?uuid=9c19275c-c3fe-43dd-b6ec-a4f2bf65810f

For each Resource that is for a Package, the for_packages for those Resources will be populated with the package_uid of the Package they are for.

We will need to create a DiscoveredDependency model to handle the dependencies from the new top-level dependency attribute from a scan.

We also need to modify the DiscoveredPackage model to better store/query the new package_uid values. Currently, we put the package_uids for a package in the extra_data field.

The serializers of these models will have to be updated as well.

The value in a Resource's for_packages field is not a purl, but a package_uid. for a particular instance of a Package detected during a scan. In the new output, multiple copies of the same package can appear in the top-level packages field. Each copy has a different package_uid. We'll have to find a way to keep the package_uids around on Resources and to display the package_uids properly in the for_packages field in the scancode.io JSON output.

[tdruez]

@JonoYang are we now ready to close this on?

[JonoYang]

@tdruez This is finished now that #486 is merged.