Backport: Fix excessive churn of vulnerable software associations during mirroring - #7256

Nearly every OSV mirror run deletes and re-inserts the `VULNERABLESOFTWARE`
<-> `VULNERABILITY` associations (and their `AFFECTEDVERSIONATTRIBUTION`
records) of ecosystems like Ubuntu, even when the affected version ranges did
not change. This bloats `VULNERABLESOFTWARE_VULNERABILITIES` and
`AFFECTEDVERSIONATTRIBUTION`, resets `firstSeen`, and makes both mirroring and
maintenance slow.

`synchronizeVulnerableSoftware` reconciles associations by matching previously
reported records against freshly parsed ones via
`VulnerableSoftware#equalsIgnoringDatastoreIdentity`. That comparison includes
the full `purl` and `purlVersion`, but the lookup it relies on to re-resolve
records matches only on the "decomposed" PURL and version range. When a stored
record's `purl` differs while those coordinates are unchanged, it fails to
match and is removed, only for the PURL-blind lookup to immediately re-resolve
the same row and re-add it.

Ubuntu's OSV data embeds the source package version in `package.purl`, and
bumps it whenever an advisory is updated. The version range derived from it
does not change, so those records churn on every run.

`purl` and `purlVersion` are derived from the decomposed coordinates that
already define a record's identity, and are exactly what the lookup matches
on. This change excludes them from `equalsIgnoringDatastoreIdentity` and
`hashCodeWithoutDatastoreIdentity`, so a record whose PURL was merely
re-serialized is correctly treated as unchanged.

(cherry picked from commit 5ebe40a)
Signed-off-by: nscuro <nscuro@protonmail.com>