Include Package URL of detected packages as external ref

[sbs2001]

Syft and k8's bom include purl as external ref.

These look like:

 "packages": [
  {
......
   "name": "ariga.io/atlas",
   "externalRefs": [
    {
     "referenceCategory": "PACKAGE_MANAGER",
     "referenceLocator": "pkg:golang/ariga.io/[email protected]",
     "referenceType": "purl"
    }
   ],
......
  },

Finding purl from the current output is tricky/impossible for further tools since the ecosystem info gets lost with current approach of only providing name and version .

[nishakm]

@sbs2001 Is adding purl externalRefs the enhancement you are asking for?

[sbs2001]

@nishakm yes