x/vulndb: import paths do not uniquely identify packages

[julieqiu]

The DB is constructed assuming that package import paths are unique. But it's possible to have two different packages with the same import path, even at the same version. Example:

https://pkg.go.dev/github.com/hashicorp/vault@v1.0.1/api
https://pkg.go.dev/github.com/hashicorp/vault/api@v1.0.1

---

Moved from golang/vulndb#5.