fix: normalize names of python packages to favor false positives over false negatives

[G-Rath]

The comments should say it all - ultimately I realised that pip-compile is probably why all the requirements.txt I have locally are using lowercase package names, and that pip probably just accepts either or and normailizes names internally.

Ultimately the OSV spec says that the name for packages in the PyPip ecosystem should be normalized, so let's normalize the names on both sides and call it a day for the time being.