The issue

leapp incorrectly handles PES events related to packages which are present in multiple repositories.

How reproducible is this bug?:

I've been able to reproduce the issue.

Expected results

leapp should properly handle PES events for packages present in multiple repositories.
If a packages is unambiguously identified by repoid matching our data, use the right PES event.

Actual results

When two PES events each state that a package is present in two different repositories, leapp currently picks the repository which is specified in the event that comes second in the pes-event.json file, which is incorrect. Seems like this is just coincidental.
(technical note, this is because of how the_hash_() function is implemented)