[Prachi194agrawal]

Fixes #2355

The v2 ghost-package improver currently reports missing packages and missing versions under the same label. This change introduces separate counts and log messages so these cases can be distinguished.

• Report a missing package once per base PURL when a registry lookup returns HTTP 404 before yielding any versions, excluding ambiguous Go and GitHub lookups.
• Report missing versions individually for PurlDB verification.
• Avoid interpreting an empty release list as proof that the package itself is missing.
• Preserve existing flags when lookups fail or return incomplete results.
• Avoid classifying unversioned entries as ghost versions, and clear previous ghost flags when a version is found upstream.

Both missing packages and missing versions retain is_ghost=True so unavailable versions remain excluded from suggested fixes. The distinction is recorded in pipeline logs and counts; this change does not add persistent classification fields or submit verification requests to PurlDB.

Adds regression coverage for separate reporting, empty release lists, unversioned packages, version-prefix normalization, lookup failures, and ambiguous or partial HTTP 404 responses.

Validation

venv/bin/python -m pytest \
  vulnerabilities/tests/pipelines/v2_improvers/test_flag_ghost_packages_v2.py \
  vulnerabilities/tests/pipelines/test_flag_ghost_packages.py \
  --reuse-db -q

Result: 25 passed, 7 warnings.