collect_manifest: Try to fix spdx package name

This tries to guess an spdx package name based on the available source information. It takes the basename from the URL and attempts to extract the package name through some heuristics. It's not perfect, but works most of the time.

One important exception are patches, which should probably not be expressed as spdx packages but rather as spdx files. For now, this keeps the old convention of calling them using the element name.