fix(vuln): compare nuget package names in lower case

[DmitriyLewen]

Description

We should compare nuget package names in lowercase to avoid cases where the advisory database contains the same package with different casing.
See #9451 for more details.

Example

CVE-2025-30399 uses a package name with Net, but the NuGet file uses uppercase NET.
before:

➜   trivy -q fs  Microsoft.NETCore.App.deps.json      

Report Summary

┌─────────────────────────────────┬─────────────┬─────────────────┬─────────┐
│             Target              │    Type     │ Vulnerabilities │ Secrets │
├─────────────────────────────────┼─────────────┼─────────────────┼─────────┤
│ Microsoft.NETCore.App.deps.json │ dotnet-core │        0        │    -    │
└─────────────────────────────────┴─────────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

after:

➜  trivy git:(fix/nuget/find-vulns-in-lower-case) ✗ ./trivy -q fs --table-mode detailed /Users/dmitriy/work/tmp/9451/Microsoft.NETCore.App.deps.json   

Microsoft.NETCore.App.deps.json (dotnet-core)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

┌──────────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬────────────────────────────────────────────┐
│                   Library                    │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                   Title                    │
├──────────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼────────────────────────────────────────────┤
│ Microsoft.NETCore.App.Runtime.linux-musl-x64 │ CVE-2025-30399 │ HIGH     │ fixed  │ 8.0.15            │ 9.0.6, 8.0.17 │ dotnet: .NET Remote Code Vulnerability     │
│                                              │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-30399 │
└──────────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴────────────────────────────────────────────┘

Related issues

• Close bug(nuget): Trivy doesn’t detect vulns when the case of the found package differs from the package in the GitHub advisory database. #9451

Related PRs

• feat(ghsa): use nuget advisories in lower case trivy-db#571

Remove this section if you don't have related PRs.

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).