feat: include package purls in JSON output

[gotgolem]

Overview

Fixes #2874.

JSON output currently includes each scanned package's name, version, and ecosystem, but not its package URL.

This PR includes the package URL when scalibr provides one.

Details

I added an optional purl field to PackageInfo and populate it from scalibr's package URL in buildVulnerabilityResults.

The field is omitted (omitempty) when no PURL is available.

Testing

• go test ./pkg/osvscanner
• go test ./internal/output
• go test ./pkg/models
• ./scripts/run_lints.sh

Checklist

• I have signed the Contributor License Agreement.
• I have run the linter using ./scripts/run_lints.sh.
• I have run the unit tests using ./scripts/run_tests.sh.
• I have made my commits and PR title follow the Conventional Commits specification.

[another-rex]

Apologies for the late review!

Im happy with the change overall, though I think the test that's added is a bit too complicated for what we're actually doing. I would say try to simplify the test or just remove it entirely.

We're currently a bit busy recently, so might be a little while before we can get this merge in, but I will try to make sure this change is in the next osv-scanner release.

[gotgolem]

@another-rex
Updated, thanks. I dropped the extra PURL-specific test since the existing snapshots already cover the JSON output.