feat(scanner): Merge duplicate scan results that share a provenance

When the SpdxDocumentFile package manager is used, the *project* and all
contained *packages* often resolve to the **same VCS provenance** (e.g. the
root of the Git repository).
Before this change ORT stored two separate `ScanResult`s for such a
provenance – one keyed to the project, one keyed to the package.

That caused two follow-on problems:

* Both results appeared in the `OrtResult`, so evaluators saw **duplicate
  findings** for the *same* source tree.
* Because projects and packages are handled by different rules the package
  result was additionally **padded with a `SpdxConstants.NONE` finding**
  whenever `includeFilesWithoutFindings` was enabled.
  The evaluator therefore compared *real* license findings from the project
  result with `NONE` from the package result and failed with a violation.

This patch

* groups scan results by the pair `(provenance, scanner)` and folds them
  into a single `ScanResult`,
* unions the inner finding sets to avoid duplicates, and
* performs the "pad with NONE" step only **after** deduplication, so every
  path is represented exactly once.

As a consequence the evaluator now receives one consistent set of license
findings per provenance / scanner, eliminating the false mismatch.

Signed-off-by: Jonatan Männchen <jonatan@maennchen.ch>

Author: maennchen

scanner/src/main/kotlin/Scanner.kt

@@ -141,15 +141,72 @@ class Scanner(
             }
         }
 
+        val filesByProvenance = (projectResults.files + packageResults.files)
+            .groupBy { it.provenance }
+            .values
+            .map { fileLists ->
+                fileLists.reduce { acc, next ->
+                    acc.copy(
+                        files = acc.files + next.files
+                    )
+                }
+            }
+            .toSet()
+
+        val deduplicatedScanResults = (projectResults.scanResults + packageResults.scanResults)
+            .groupBy { it.provenance to it.scanner }
+            .values
+            .map { scanResults ->
+                scanResults.reduce { acc, next ->
+                    acc.copy(
+                        summary = acc.summary.copy(
+                            startTime = minOf(acc.summary.startTime, next.summary.startTime),
+                            endTime = maxOf(acc.summary.endTime, next.summary.endTime),
+                            licenseFindings = acc.summary.licenseFindings.union(next.summary.licenseFindings),
+                            copyrightFindings = acc.summary.copyrightFindings.union(next.summary.copyrightFindings),
+                            snippetFindings = acc.summary.snippetFindings.union(next.summary.snippetFindings),
+                            issues = acc.summary.issues + next.summary.issues
+                        ),
+                        additionalData = acc.additionalData + next.additionalData
+                    )
+                }
+            }
+            .toSet()
+
+        val pathsByProvenance = filesByProvenance.associate {
+            it.provenance to it.files.map { file -> file.path }.toSet()
+        }
+
+        val checkedScanResults = if (scannerConfig.includeFilesWithoutFindings) {
+            deduplicatedScanResults.mapTo(mutableSetOf()) { scanResult ->
+                val allPaths = pathsByProvenance[scanResult.provenance].orEmpty()
+
+                val pathsWithFindings = scanResult.summary.licenseFindings.mapTo(mutableSetOf()) { it.location.path }
+                val pathsWithoutFindings = allPaths - pathsWithFindings
+
+                val findingsThatAreNone = pathsWithoutFindings.mapTo(mutableSetOf()) {
+                    LicenseFinding(SpdxConstants.NONE, TextLocation(it, TextLocation.UNKNOWN_LINE))
+                }
+
+                scanResult.copy(
+                    summary = scanResult.summary.copy(
+                        licenseFindings = scanResult.summary.licenseFindings + findingsThatAreNone
+                    )
+                )
+            }
+        } else {
+            deduplicatedScanResults
+        }
+
         val scannerRun = ScannerRun(
             startTime = startTime,
             endTime = endTime,
             environment = Environment(toolVersions = toolVersions),
             config = scannerConfig,
             provenances = projectResults.provenances + packageResults.provenances,
-            scanResults = projectResults.scanResults + packageResults.scanResults,
+            scanResults = checkedScanResults,
             issues = projectResults.issues + packageResults.issues,
-            files = projectResults.files + packageResults.files,
+            files = filesByProvenance,
             scanners = projectResults.scanners + packageResults.scanners
         )
 
@@ -193,7 +250,7 @@ class Scanner(
 
         val vcsPathsForProvenances = getVcsPathsForProvenances(provenances)
 
-        val filteredScanResults = filterScanResultsByVcsPaths(controller.getAllScanResults(), vcsPathsForProvenances)
+        val scanResults = filterScanResultsByVcsPaths(controller.getAllScanResults(), vcsPathsForProvenances)
 
         val files = controller.getAllFileLists().mapTo(mutableSetOf()) { (provenance, fileList) ->
             FileList(
@@ -208,29 +265,6 @@ class Scanner(
             }
         }
 
-        val scanResults = if (scannerConfig.includeFilesWithoutFindings) {
-            filteredScanResults.mapTo(mutableSetOf()) { scanResult ->
-                val allPaths = controller.getAllFileLists()[scanResult.provenance]?.files?.mapTo(mutableSetOf()) {
-                    it.path
-                }.orEmpty()
-
-                val pathsWithFindings = scanResult.summary.licenseFindings.mapTo(mutableSetOf()) { it.location.path }
-                val pathsWithoutFindings = allPaths - pathsWithFindings
-
-                val findingsThatAreNone = pathsWithoutFindings.mapTo(mutableSetOf()) {
-                    LicenseFinding(SpdxConstants.NONE, TextLocation(it, TextLocation.UNKNOWN_LINE))
-                }
-
-                scanResult.copy(
-                    summary = scanResult.summary.copy(
-                        licenseFindings = scanResult.summary.licenseFindings + findingsThatAreNone
-                    )
-                )
-            }
-        } else {
-            filteredScanResults
-        }
-
         val scannerIds = scannerWrappers.mapTo(mutableSetOf()) { it.descriptor.id }
         val scanners = packages.associateBy({ it.id }) { scannerIds }