Avoid double-free in cached PDB

The cached PDB maintains a mapping from dependency strings to package
objects, and ensures that if the same dependency is requested multiple
times, you get the same package instance.  It used to assume that
different dependency strings would map to different package objects.
That's not the case, however; the native and built PDBs can both produce
the same package object for different dependency strings, if the
dependencies refer to different (satisfied) minimum versions of a single
package.  That would cause the cached PDB to try to free that single
package multiple times.

So, now the cached PDB maintains a set of package objects, in addition
to the name → package mapping.  That way we can free each package once,
regardless of how many times it's used.