Use correct source/binary artifacts for reference QA sub-workflow

Using the candidate source package and binaries with the same source name and version in qa_suite made no sense: those typically won't exist, since the candidate will normally have a previously-unused version number.

Pick the current version of the source package in qa_suite with the same name as the candidate instead, and its associated binaries.