Assign source aliases if no alias group is defined

[hogo6002]

Some vulnerabilities may lack listed aliases, even if their source data contains them. This occurs when an alias_group exceeds a maximum number of aliases, causing this group to be not added. For example: https://osv.dev/vulnerability/GO-2024-2947

In such cases, assign the original source aliases to the aliases field to match with the source info.

Fixes: #2374

[hogo6002]

This can also cause issues where a vulnerability lists different aliases with its alias. Also, the raw aliases may sometimes exceed the maximum number of vulnerabilities allowed. Not sure if we really want to implement this. @michaelkedar

[michaelkedar]

Yeah, my main issue with doing this is that there's no indication when we do fall back to the raw aliases and, when we do, the returned alias lists become no longer symmetric. So it still can be confusing to consumers...

[hogo6002]

This seems not the right approach, close the PR for now.