Cannot assign multiple resources to the same Package using `update_or_create_package`

[JonoYang]

In my pipeline, I am trying to associate multiple resources to the same package using update_or_create_package (https://github.com/nexB/purldb/blob/49-on-demand-mining/matchcode-toolkit/src/matchcode_toolkit/pipelines/matching.py#L227). However, this only results in one Resource being associated to a package, despite update_or_create_package being called on all of the Resources that should be associated.

The issue occurs in update_or_create_package at https://github.com/nexB/scancode.io/blob/main/scanpipe/pipes/__init__.py#L123 where if the package already exists, we just update the package data and don't associate a codebase resource to that package, even if a codebase resource has been passed into the function.

[tdruez]

@JonoYang Thanks for starting this.
I've added multiple changes to the PR adding the ability to provide a list of codebase resources to the function along fixing some bugs related to the package_uid.
This should be much more efficient than calling the function multiple times (less DB lookup too).
Let me know if those work for you :)