feat: Add PURL list input/output format

[kzantow]

Description

This PR adds a purls format (with aliases: purl). This allows a user to export and by association convert to and from a list of PURLs:

# instead of an SBOM, get a list of PURLs
$ syft -q alpine:latest -o purl 

pkg:apk/alpine/alpine-baselayout@3.6.8-r1?arch=aarch64&distro=alpine-3.21.3
pkg:apk/alpine/alpine-baselayout-data@3.6.8-r1?arch=aarch64&distro=alpine-3.21.3&upstream=alpine-baselayout
pkg:apk/alpine/alpine-keys@2.5-r0?arch=aarch64&distro=alpine-3.21.3
pkg:apk/alpine/alpine-release@3.21.3-r0?arch=aarch64&distro=alpine-3.21.3&upstream=alpine-base
pkg:apk/alpine/apk-tools@2.14.6-r3?arch=aarch64&distro=alpine-3.21.3
pkg:apk/alpine/busybox@1.37.0-r12?arch=aarch64&distro=alpine-3.21.3
pkg:apk/alpine/busybox-binsh@1.37.0-r12?arch=aarch64&distro=alpine-3.21.3&upstream=busybox
pkg:apk/alpine/ca-certificates-bundle@20241121-r1?arch=aarch64&distro=alpine-3.21.3&upstream=ca-certificates
pkg:apk/alpine/libcrypto3@3.3.3-r0?arch=aarch64&distro=alpine-3.21.3&upstream=openssl
pkg:apk/alpine/libssl3@3.3.3-r0?arch=aarch64&distro=alpine-3.21.3&upstream=openssl
pkg:apk/alpine/musl@1.2.5-r9?arch=aarch64&distro=alpine-3.21.3
pkg:apk/alpine/musl-utils@1.2.5-r9?arch=aarch64&distro=alpine-3.21.3&upstream=musl
pkg:apk/alpine/scanelf@1.3.8-r1?arch=aarch64&distro=alpine-3.21.3&upstream=pax-utils
pkg:apk/alpine/ssl_client@1.37.0-r12?arch=aarch64&distro=alpine-3.21.3&upstream=busybox
pkg:apk/alpine/zlib@1.3.1-r2?arch=aarch64&distro=alpine-3.21.3

# converting from SPDX json to a list of PURLs
$ syft -q convert alpine.spdx.json -o purl 

pkg:apk/alpine/alpine-baselayout@3.6.8-r1?arch=aarch64&distro=alpine-3.21.3
pkg:apk/alpine/alpine-baselayout-data@3.6.8-r1?arch=aarch64&distro=alpine-3.21.3&upstream=alpine-baselayout
pkg:apk/alpine/alpine-keys@2.5-r0?arch=aarch64&distro=alpine-3.21.3
pkg:apk/alpine/alpine-release@3.21.3-r0?arch=aarch64&distro=alpine-3.21.3&upstream=alpine-base
pkg:apk/alpine/apk-tools@2.14.6-r3?arch=aarch64&distro=alpine-3.21.3
pkg:apk/alpine/busybox@1.37.0-r12?arch=aarch64&distro=alpine-3.21.3
pkg:apk/alpine/busybox-binsh@1.37.0-r12?arch=aarch64&distro=alpine-3.21.3&upstream=busybox
pkg:apk/alpine/ca-certificates-bundle@20241121-r1?arch=aarch64&distro=alpine-3.21.3&upstream=ca-certificates
pkg:apk/alpine/libcrypto3@3.3.3-r0?arch=aarch64&distro=alpine-3.21.3&upstream=openssl
pkg:apk/alpine/libssl3@3.3.3-r0?arch=aarch64&distro=alpine-3.21.3&upstream=openssl
pkg:apk/alpine/musl@1.2.5-r9?arch=aarch64&distro=alpine-3.21.3
pkg:apk/alpine/musl-utils@1.2.5-r9?arch=aarch64&distro=alpine-3.21.3&upstream=musl
pkg:apk/alpine/scanelf@1.3.8-r1?arch=aarch64&distro=alpine-3.21.3&upstream=pax-utils
pkg:apk/alpine/ssl_client@1.37.0-r12?arch=aarch64&distro=alpine-3.21.3&upstream=busybox
pkg:apk/alpine/zlib@1.3.1-r2?arch=aarch64&distro=alpine-3.21.3

Additionally, after reading an SBOM, formats are able to "enhance" Syft package data from information in the PURL if the data isn't present in the package. For example: a maven PURL includes the GroupID, something like: pkg:maven/org.apache/something, but this GroupID was not being mapped to the internal data location for GroupID which could result in false positives in Grype. This happens for PURL input as well as other formats including SPDX and CycloneDX in order to improve support for SBOMs created with tools other than Syft.

• Fixes CycloneDX group field not symmetrically handled by encoder/decoders #2981
• Grype false negatives in versions v0.88.0 and later leading to missed critical vulnerabilities grype#2628
• Dropping group from npm package names leads to false positives grype#2554
• @jridgewell/gen-mapping incorrectly attributed GHSA-8rmg-jf7p-4p22 grype#1886
• Vulnerability reported on @group/name dependency when actual vulnerability exists on name dependency grype#1701

Type of change

• New feature (non-breaking change which adds functionality)

Checklist:

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

[wagoodman]

Added a few comments, but crosses the threshold of mergable for me 👍