fix: normalize apk package fallback versions for CPE matching - #3687

When a package CPE has an unspecified version (*, -, or unknown), FindResultsByCPEs falls back to p.Version. For APK packages, that fallback used the raw package version because cpeversion.Alpine(...) had already run.

This moves APK CPE-version normalization after the fallback and adds a regression for an unversioned OpenSSL CPE. The fixture also has a < 1.0.1f control record so the normalized 1.0.1f search does not over-match.

Checked:

• go test ./grype/matcher/internal -run 'TestFindMatchesByPackageCPE/fallback_to_apk_package_version_normalizes_build_suffix' -count=1
• go test -race ./grype/matcher/internal -run 'TestFindMatchesByPackageCPE/fallback_to_apk_package_version_normalizes_build_suffix' -count=5
• go test ./grype/matcher/internal ./grype/matcher/internal/result ./grype/matcher/apk -count=1
• go test ./grype/matcher/... -count=1
• make static-analysis
• git diff --check