Encode upstream qualifier on OS package pURLs

[wagoodman]

This adds an additional upstream qualifier to the pURLs that we generate for OS-related packages to indicate source package information.

The pURL spec does not strictly support this qualifier, however, it does seem like the best current option for encoding source-package information for a package.

Related to anchore/grype#395

cc: @kzantow

[github-actions]

Benchmark Test Results

Benchmark results from the latest changes vs base branch

name                                                       old time/op    new time/op    delta
ImagePackageCatalogers/ruby-gemspec-cataloger-2              1.77ms ± 8%    1.65ms ± 7%    ~     (p=0.056 n=5+5)
ImagePackageCatalogers/python-package-cataloger-2            3.95ms ± 3%    3.65ms ± 1%  -7.74%  (p=0.008 n=5+5)
ImagePackageCatalogers/php-composer-installed-cataloger-2    1.36ms ± 2%    1.24ms ± 2%  -8.72%  (p=0.008 n=5+5)
ImagePackageCatalogers/javascript-package-cataloger-2        1.07ms ± 5%    1.04ms ± 7%    ~     (p=0.310 n=5+5)
ImagePackageCatalogers/dpkgdb-cataloger-2                    1.23ms ± 3%    1.24ms ± 1%    ~     (p=0.310 n=5+5)
ImagePackageCatalogers/rpmdb-cataloger-2                     1.09ms ± 3%    1.11ms ± 0%    ~     (p=0.190 n=5+4)
ImagePackageCatalogers/java-cataloger-2                      17.4ms ± 2%    16.6ms ± 3%  -4.29%  (p=0.008 n=5+5)
ImagePackageCatalogers/apkdb-cataloger-2                     1.63ms ± 6%    1.60ms ± 5%    ~     (p=0.548 n=5+5)
ImagePackageCatalogers/go-module-binary-cataloger-2          2.35µs ± 1%    2.23µs ± 6%    ~     (p=0.095 n=5+5)

name                                                       old alloc/op   new alloc/op   delta
ImagePackageCatalogers/ruby-gemspec-cataloger-2               253kB ± 0%     253kB ± 0%  +0.20%  (p=0.008 n=5+5)
ImagePackageCatalogers/python-package-cataloger-2            1.06MB ± 0%    1.07MB ± 0%    ~     (p=0.095 n=5+5)
ImagePackageCatalogers/php-composer-installed-cataloger-2     253kB ± 0%     254kB ± 0%    ~     (p=0.222 n=5+5)
ImagePackageCatalogers/javascript-package-cataloger-2         208kB ± 0%     208kB ± 0%  +0.14%  (p=0.032 n=5+5)
ImagePackageCatalogers/dpkgdb-cataloger-2                     254kB ± 0%     255kB ± 0%  +0.17%  (p=0.008 n=5+5)
ImagePackageCatalogers/rpmdb-cataloger-2                      236kB ± 0%     236kB ± 0%  +0.11%  (p=0.016 n=5+5)
ImagePackageCatalogers/java-cataloger-2                      3.78MB ± 0%    3.78MB ± 0%    ~     (p=0.690 n=5+5)
ImagePackageCatalogers/apkdb-cataloger-2                     1.30MB ± 0%    1.30MB ± 0%  +0.10%  (p=0.032 n=5+5)
ImagePackageCatalogers/go-module-binary-cataloger-2            560B ± 0%      560B ± 0%    ~     (all equal)

name                                                       old allocs/op  new allocs/op  delta
ImagePackageCatalogers/ruby-gemspec-cataloger-2               6.33k ± 0%     6.33k ± 0%    ~     (p=1.000 n=5+5)
ImagePackageCatalogers/python-package-cataloger-2             21.4k ± 0%     21.4k ± 0%    ~     (p=1.000 n=5+5)
ImagePackageCatalogers/php-composer-installed-cataloger-2     7.26k ± 0%     7.26k ± 0%    ~     (p=1.000 n=5+5)
ImagePackageCatalogers/javascript-package-cataloger-2         5.34k ± 0%     5.34k ± 0%    ~     (all equal)
ImagePackageCatalogers/dpkgdb-cataloger-2                     7.10k ± 0%     7.11k ± 0%  +0.08%  (p=0.008 n=5+5)
ImagePackageCatalogers/rpmdb-cataloger-2                      6.82k ± 0%     6.83k ± 0%  +0.09%  (p=0.008 n=5+5)
ImagePackageCatalogers/java-cataloger-2                       74.7k ± 0%     74.7k ± 0%  -0.02%  (p=0.016 n=5+5)
ImagePackageCatalogers/apkdb-cataloger-2                      7.36k ± 0%     7.38k ± 0%  +0.17%  (p=0.016 n=4+5)
ImagePackageCatalogers/go-module-binary-cataloger-2            13.0 ± 0%      13.0 ± 0%    ~     (all equal)