feat(cyclonedx): output source PURL as external reference

[swadaptive]

Description

Adds an additional external reference to package components that are associated with a source package. Main use case is to aid vulnerability matching in ecosystems that report vulnerabilities against source packages instead of the binary package that syft detected was actually installed. Similar use case to the non-standard upstream PURL qualifier that syft and grype already implement (which this PR leaves untouched).

Uses the external reference type source-distribution that was introduced in CycloneDX v1.6 in combination with the pkg PackageURL URI scheme that was added to the IANA registry in July to indicate a source PURL which can be matched against vulnerability databases. I expect this change to make it easier for other vulnerability scanners to make use of the upstream source information without committing to support the syft-specific upstream qualifier.

Note: This change exposes a bug in cyclonedx-go when encoding SBOMs. The library doesn't properly flag / filter externalReference types that were introduced later as invalid in earlier versions of the spec. With this change syft will output invalid documents for CycloneDX 1.5 or below until the bug is fixed upstream.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (please discuss with the team first; Syft is 1.0 software and we won't accept breaking changes without going to 2.0)
• Documentation (updates the documentation)
• Chore (improve the developer experience, fix a test flake, etc, without changing the visible behavior of Syft)
• Performance (make Syft run faster or use less memory, without changing visible behavior much)

Checklist

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

Issue references

• Related feature request: Syft cycloneDX: create sBOM data from source packages instead of binary packages (e.g. debian packages) ? #1700
• CycloneDX spec discussion: [FEATURE]: component type "source" CycloneDX/specification#612 (comment)