PyPI packages are not reported as vulnerable if name is not normalized

[eleftherias]

Describe the issue

The OSV API expects python package names to be normalized.

From the OSV schema:

the name field is a normalized PyPI package name.

Their definition of normalization is:

The name should be lowercased with all runs of the characters ., -, or _ replaced with a single - character.

An example of this is the Django package.
When installing Django, the name in requirements.txt is Django with an uppercase D.

However, sending that package name to the OSV API returns empty, even when there is a vulnerability in the given version.

Example:

 curl -d  '{"package": {"ecosystem": "PyPI", "name": "Django"}, "version": "3.2.21"}' "https://api.osv.dev/v1/query"

returns empty.

While:

 curl -d  '{"package": {"ecosystem": "PyPI", "name": "django"}, "version": "3.2.21"}' "https://api.osv.dev/v1/query"

returns several vulnerabilities.

To Reproduce

No response

What version are you using?

No response