fix: don't index nested packages under the outer archive path

`indexedPaths` added each location's `RealPath`, which for a nested file is the outermost archive. So
`PackagesByPath("/opt/x.jar")` returned every package found inside it at any depth, a root OS package
owning that file got ownership-overlap edges to all of them, and
`ExcludeBinaryPackagesWithFileOwnershipOverlap` then deleted nested binary, ELF and JVM packages.

Packages are now indexed by full path and access path only. An archive's own package still sits at
root coordinates and is found by its path; what's inside it stays linked to it by CONTAINS edges
rather than by ownership of the archive file.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

internal/relationship/by_file_ownership_test.go

@@ -103,7 +103,9 @@ func TestOwnershipByFilesRelationship(t *testing.T) {
 			},
 		},
 		{
-			name: "top-level-owner-of-an-archive-owns-packages-within-it",
+			// the archive's own package (when it has one) is found by its path; what is inside it is
+			// linked to that package by CONTAINS, not owned by whoever owns the archive file
+			name: "top-level-owner-of-an-archive-does-not-own-packages-within-it",
 			setup: func(t testing.TB) ([]pkg.Package, []artifact.Relationship) {
 				parent := pkg.Package{
 					Locations: file.NewLocationSet(file.NewLocation("/var/lib/rpm/Packages")),
@@ -123,14 +125,7 @@ func TestOwnershipByFilesRelationship(t *testing.T) {
 				}
 				child.SetID()
 
-				relationship := artifact.Relationship{
-					From: parent,
-					To:   child,
-					Type: artifact.OwnershipByFileOverlapRelationship,
-					Data: ownershipByFilesMetadata{Files: []string{"/opt/bundle.tar"}},
-				}
-
-				return []pkg.Package{parent, child}, []artifact.Relationship{relationship}
+				return []pkg.Package{parent, child}, nil
 			},
 		},
 		{