Get source rpm from purl

[thegreyd]

We rely on "syft:metadata:sourceRpm" which is generated by syft, the cli tool konflux uses to generate sbom.
It is not the official identifier in the sbom spec, it can go away if another tool is used.
Instead rely on purl which is the identifier in the sbom spec
https://cyclonedx.org/docs/1.6/json/#components_items_purl
Use https://github.com/package-url/packageurl-python to parse purl

Note: https://cyclonedx-python-library.readthedocs.io/en/latest/schema-support.html is a nice lib to
work with the whole sbom, but lacks support for some schema keys in the latest version which konflux uses.

[thegreyd]

/hold
Need to test.

[openshift-ci]

@thegreyd: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/security	8020d67	link	false	/test security

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[vfreex]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vfreex

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [vfreex]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment