internal/api: improve ambiguous package path resolution

Instead of falling back to UnknownModulePath, we now:

1. Query all candidate module paths.
2. Filter out candidates where the database fell back to a different module path (preventing false positives like google.golang.org).
3. Filter out deprecated or retracted candidates if at least one good candidate exists.
4. Return 400 if ambiguity remains among good candidates.

This commit fixes the issue where /v1/package/google.golang.org/adk/agent was returning HTTP 400 because all candidate module paths matched:

```
{
 "code":400,
 "message":"ambiguous package path",
 "candidates":[
  {"modulePath":"google.golang.org/adk/agent","packagePath":"google.golang.org/adk/agent"},
  {"modulePath":"google.golang.org/adk","packagePath":"google.golang.org/adk/agent"},
  {"modulePath":"google.golang.org","packagePath":"google.golang.org/adk/agent"}]
}
```

Change-Id: I3ea24bca5144d536490019efd85fb597da214029
Reviewed-on: https://go-review.googlesource.com/c/pkgsite/+/766380
kokoro-CI: kokoro <noreply+kokoro@google.com>
Reviewed-by: Jonathan Amsterdam <jba@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

0 files changed, 0 insertions, 0 deletions