Only add an ecosystem version range if there's package information (#845)
Only add an ecosystem version range if there's package information (#845)

ecosystem-specific version ranges are only meaningful in conjuction with
package information, so only add them to the resulting vulnerability
record if package information is present.

Break out the Package to its own struct so it doesn't get emitted when
there is no package information.

Adjust AddPkgInfo accordingly
google/osv.dev,google/osv.dev,google/osv.dev,google/osv.dev,google/osv.dev