[BUG] Dedupe treats one manifest spelled two ways as two manifests

_distinct_manifest_paths decides "is this the same dependency in a different manifest" by comparing the raw manifest_path strings, and that path is authored by the model, so one manifest arrives in several spellings:

_distinct_manifest_paths({"dependency_metadata": {"manifest_path": "package.json"}},
                         {"dependency_metadata": {"manifest_path": "./package.json"}})
# -> True   (two "different" manifests)

The same holds for package.json//, a//package.json, .\\package.json and /a/../a/package.json. Because the result is True, the duplicate is kept as a second finding: one vulnerable dependency in one manifest gets reported twice, and the agent spends turns re-triaging it.

Expected: spellings of the same path compare equal, while an absolute path still differs from a relative one and two genuinely different manifests stay two findings.