Support per-dependency package identities in Parse

[abhinavgautam01]

Fixes #111

Problem

Parse builds every dependency's PURL from the file's ecosystem and overwrites any PURL the parser supplied. Declarations already keeps a parser-supplied PURL, so the two collections behave differently. Mixed-ecosystem files get the wrong identity. For example, npm:lodash in deno.json comes out as pkg:deno/lodash instead of pkg:npm/lodash.

Changes

Two optional fields on Dependency and Declaration. Both changes are additive: no Parse signature or existing field type changes.

field	meaning
Ecosystem string	PURL type when it differs from the file's ecosystem. Empty means the file's ecosystem.
NoPURL bool	Source-only entry with no known package identity, such as a direct download URL.

Dependencies and Declarations now resolve PURLs with the same rule:

1. NoPURL leaves the PURL empty. The entry keeps its location in Source.
2. A parser-supplied PURL is preserved as written.
3. Otherwise the PURL is built from Ecosystem, falling back to the file's ecosystem.

The existing version rule is unchanged: manifest PURLs leave out the version, lockfile and supplement PURLs include it and declaration PURLs never do. No existing parser sets these fields, so output for every parser that does not opt in is unchanged.

deno.json npm: imports and the npm section of deno.lock now opt in with Ecosystem: "npm". JSR packages keep the deno fallback.

entry	before	after
deno.json npm:lodash	pkg:deno/lodash	pkg:npm/lodash
deno.lock npm lodash	pkg:deno/lodash@4.17.21	pkg:npm/lodash@4.17.21
deno.json jsr:@std/path	pkg:deno/%40std%2Fpath	unchanged

No new coordinate normalization was added. Everything still goes through purl.BuildPURLString. The README documents the new fields and the resolution order.

Tests

All tests go through public Parse:

• TestDependencyPackageIdentity and TestDeclarationPackageIdentity use a test-only parser registered for manifest and lockfile filenames. It covers the fallback, an Ecosystem override, an explicit PURL, a NoPURL jar URL that keeps its Source and NoPURL overriding a PURL. Each case is checked with and without versions.
• TestManifestDependencyAndDeclarationIdentitiesMatch checks that manifest dependencies and their declarations resolve to the same identity.
• TestDenoNPMImportPURLs asserts the exact PURLs for deno.json and deno.lock.

Every new test fails without the manifests.go and deno.go changes. go build ./..., go vet ./..., go test -race ./... and golangci-lint run all pass.

[andrew]

This matches #111 closely. A few changes before merge:

1. Parse should set Ecosystem on every dependency and declaration, not only the ones whose parser set it. As it stands, most entries come back with an empty Ecosystem, so a consumer has to know to fall back to ParseResult.Ecosystem. dependencyPURL and declarationPURL already compute cmp.Or(dep.Ecosystem, ecosystem), so store that on the field as well. Entries with NoPURL should keep an empty Ecosystem, since they have no package identity. Update the field comments, the README and the tests to match.
2. The comments in internal/core/types.go and the README describe Ecosystem as a PURL type. The value goes through purl.BuildPURLString, which normalises it as an ecosystem name, so PURL types like apk or github won't map correctly. Describe it as an ecosystem name in the same form as ParseResult.Ecosystem.
3. In the README Declaration struct block, the new and changed fields are padded to a different column than Name, Version, Scope, Direct and Source.