[Feature]: better handling of non-unique package names in find-package workflows

[lunarcloud]

Problem Statement

find-package ambiguity in SBOMs with duplicate package names should provide candidate details and deterministic selection options

This would prevent brittle pipeline behavior like yours and remove the need for custom workflow forks.

Proposed Solution

1. Actionable ambiguity errors: when find-package matches multiple packages, include the matched candidates (ID, name, version, filename/download URL) in the error output.
2. Built-in disambiguation options: support find-package modes like --unique-by name+version, --prefer-explicitly-referenced, or --select first|latest|exact.
3. Workflow-level fallback: in EnhancePackageFromNugetSpdx.yaml, allow an optional version parameter and pass it into all find-package calls (so name-only matching is not required).

Alternatives Considered

No response

Usage Examples

Benefits

Users with multiple package versions in their dependency graph will be less confused

Priority

Low - Nice to have

Willingness to Contribute

No, I'm just suggesting

Additional Context

No response

Checklist

• I have searched existing issues to ensure this is not a duplicate
• I have provided a clear description of the feature
• I have explained why this feature would be useful