pub fn normalize_package_name(ecosystem: &str, package_name: &str) -> String
Normalize a package name for stable matching/indexing.