snapmatch: handle debian source package variants

Occasionally there may be source package variants also in Debian, i.e. packages with the same name and version but with a different set of source files depending on target arch or on other factors.

More precisely, there may be multiple file names for the same checksum (eg. in perl 5.30.1~rc1-1):

or multiple checksums for the same filename (eg. in libaio 0.3.111-1); This means that there may be even more than one .dsc file for the same source package (eg. in libaio 0.3.111-1):

Moreover, while Snapshot Debian API use only sha1 checksums, some .dsc files may contain only md5 checksums of source files.

So we need a slightly more complex logic that one may expect to reliably collect all relevant source files and related metadata from Snapshot Debian API even in "package variant" cases and avoid errors when fetching sources.