Add Improver to find out Ghost packages

[TG1999]

We have some packages coming from security advisories that doesn't exist anywhere, we should have an improver to verify if a package actually exists.

See also:

• Add improver to validate that collected purl are real. #644
• Package managers may not contain/report all versions related to a package #1144

[armijnhemel]

Would this be an improver per data source or a generic improver covering all data sources? Take for example #915, it could be an improver looking at (historical) package information from Alpine and specifically for Alpine.

[sify21]

Just add an example of typosquatting attack advisory from rust:
https://github.com/rustsec/advisory-db/blob/main/crates/rustdecimal/RUSTSEC-2022-0042.md
What should be done for this kind of advisory that doesn't have related package/version? Just ignore them?

[keshav-space]

Some of these non-existent packages could be the result of incorrect parsing of version ranges from upstream advisories #1516.