package-nvr: correctly work with separate headers

For Fedora, headers are downloaded separately, which means multiple src RPMs are now present.

Clean this all up a bit, and make sure to get the source NVR before downloading the headers.

Example for a broken checkout: https://datawarehouse.cki-project.org/api/1/kcidb/checkouts/135653

        "source_package_version": "6.7.10\n6.7.3",
        "source_package_release": "200.fc39\n200.fc39",

Part of infrastructure#318 (closed)