Provide the alternatives to an appstream id together with the URL

This way we can count on the symmetry and don't reach cases like in the
closed bug report where the flatpak id is not offered by the one coming
from packagekit but not vice-versa.

BUG: 441299