fix(poetry): handle package names in a case-insensitive manner

[knqyf263]

Description

It looks like package names in pyproject.toml are lowercased in poetry.lock.

$ cat pyproject.toml
[tool.poetry]
name = "poetry-test"
version = "0.1.0"
description = ""
readme = "README.md"

[tool.poetry.dependencies]
python = "^3.11"
pytest = ">=2.8.0,<=6.2.5"
pytest-httpbin = "==1.0.0"
pytest-mock = "==2.0.0"
httpbin = "==0.7.0"
Flask = ">=1.0,<2.0"
trustme = { version = "*"}
wheel = { version = "*"}


[build-system]
requires = ["poetry-core"]
build-backend = "poetry.core.masonry.api"

$ grep -B1 -A4 'name = "flask"' poetry.lock
[[package]]
name = "flask"
version = "1.1.2"
description = "A simple framework for building complex web applications."
optional = false
python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*"

Flask and flask don't match here, causing the wrong relationship (Flask is recognized as an indirect dependency).

trivy/pkg/fanal/analyzer/language/python/poetry/poetry.go

Lines 107 to 112 in ebb123f

	if _, ok := p[pkg.Name]; ok {
	app.Packages[i].Relationship = types.RelationshipDirect
	} else {
	app.Packages[i].Indirect = true
	app.Packages[i].Relationship = types.RelationshipIndirect
	}

[nikpivkin]

@DmitriyLewen By the way, the PEP says that package name comparisons must consider hyphens and underscores to be equivalent. https://peps.python.org/pep-0426/#name

[DmitriyLewen]

Wow, thanks! I will check this!