Support matching dependency information using information outside of NVD CPE/packageURL (e.g. packageName) #8845

Raised from #8840 (comment)

CVE-2026-89425 (via NVD API) has no packageURL / CPE so it's not being matched with any dependency. But it should be possible to match instead based on another field - e.g. packageName (com.fasterxml.jackson.core:jackson-core)

Note - in this scenario, it appears the packageURL is missing this information because NVD have not "enriched" it - there is also no NVD score - so the value gained from such a match is limited. I am unsure if other examples of this same situation have the same specifics.