if we cannot determine package owner, say "unknown"

Sometimes we get a module uploaded for a dist that has maintainers, but no primary.  In this case, we should say we don't know the owner, rather than an empty string and a warning.

(In the future, this can be improved to give a list of co-maints.)