Follow-up from "collect_manifest: Try to fix spdx package name"

The following discussion from !381 (merged) should be addressed:

• @alex.harvey.dev started a discussion: (+3 comments)

  After thinking about it some more, are we sure we want this to give a hard error if the package name can't be extracted? Wouldn't it be better to revert back to the old method of identifying sources and output a warning instead?