Dependency package_id backfill can link dependencies to the wrong registry

[abhinavgautam01]

Dependency#find_package_id and Dependency.update_missing_package_ids resolve dependency package records by ecosystem only:

• Dependency#find_package_id uses Registry.find_by_ecosystem(ecosystem)
• Dependency.update_missing_package_ids picks the first registry for the dependency ecosystem, ordered by packages_count

This can link dependencies to the wrong package record when an ecosystem has multiple registries. Maven is the clearest case because the seed data includes several Maven registries and package names can overlap between registries.

Example failure mode:

1. A version from maven.google.com has a dependency on com.example:library.
2. Dependency.update_missing_package_ids picks repo1.maven.org because it is the first/largest Maven registry.
3. If repo1.maven.org also has com.example:library, the dependency gets package_id for the wrong registry.
4. Once package_id is set, later backfills skip it because the dependency is no longer without_package.

The dependency already has enough context to resolve this correctly through its owning version/package:

dependency.version.package.registry

Using that registry would keep dependency links scoped to the registry where the dependent version came from.

Relevant code:

• app/models/dependency.rb#find_package_id
• app/models/dependency.rb#update_missing_package_ids