Weldr API endpoints and the JSON store, used only by Weldr API, directly use `rpmmd` data structures representing packages for serialization. This means that any changes to the data structures in `osbuild/images` affect Weldr API endpoint responses and the store. This PR decouples Weldr API endpoints and store from `rpmmd` structures.

Note that the `rpmmd.RepoConfig` is still used for serialization. It may make sense to decouple it in the future as well, but I omitted it at this point because it does not block the refactoring I plan to do in `osbuild/images` as part of the SBOM rearchitecture.

/jira-epic HMS-8910