fix(java): use `go-mvn-version` to remove `Package` duplicates

[DmitriyLewen]

Description

We remove duplicates of packages. But there are cases when Packages uses same version, but one of package omits 0 patch version (e.g. 2.17.0 and 2.17).

Using go-mvn-version to compare version solves this problem.

before:

➜ trivy -q image apachepulsar/pulsar:3.3.0 --format cyclonedx | grep '"purl": "pkg:maven/org.glassfish.jersey.containers/jersey-container-servlet-core'
      "purl": "pkg:maven/org.glassfish.jersey.containers/jersey-container-servlet-core@2.41",
      "purl": "pkg:maven/org.glassfish.jersey.containers/jersey-container-servlet-core@2.41.0",

after:

➜ trivy -q image apachepulsar/pulsar:3.3.0 --format cyclonedx | grep '"purl": "pkg:maven/org.glassfish.jersey.containers/jersey-container-servlet-core'
      "purl": "pkg:maven/org.glassfish.jersey.containers/jersey-container-servlet-core@2.41",

Related issues

• Close #7086

Checklist

• [x] I've read the guidelines for contributing to this repository.
• [x] I've followed the conventions in the PR title.
• [x] I've added tests that prove my fix is effective or that my feature works.
• [ ] I've updated the documentation with the relevant information (if needed).
• [ ] I've added usage information (if the PR introduces new options)
• [x] I've included a "before" and "after" example to the description (if the PR is a user interface change).