feat: add purl as a CLI options

[tromai]

Description

This Pull request adds a CLI option to Macaron, called -purl/--package-url, for the user to provide the Package URL (see the specification here) for the main analysis software component.

Types of PURL this feature supports.

A "repo-based" PURL.

According to the PURL specification, a PURL string could be used to reference a git repository path.
The format for a "repo-based" PURL would be:

pkg:<type>/<organization>/<repo-name>

Where:

• type: could be the pre-defined types for git-based packages as mentioned here. At the current time of this PR, there are only two git-based PURL: github and bitbucket. However, the user could use the git service domain as the type (e.g. github.com or gitlab.com).
• organization/repo-name: the repository fullname, which is expected to have 2 components. Example: apache/maven or oracle/macaron,

Other PURL types

At this stage, this type contains PURL strings which do not belong to the first type.

Supported use case

Provide the repository path

This use case is what Macaron has been offering. No changes are made to it.

Provide PURL only

When only the PURL is provided for the main software component:

• If that PURL is a repo-based PURL, Macaron can find the repository for it and run the current checks against that repository.
• If that PURL is not a repo-based PURL, Macaron would still create a software component entry (see feat!: introduce a new data model and software components based on PURL #305 for more information) but because Macaron could not find a repository path at this stage (upcoming PR would try to address this issue), the checks won't be run against this software component.

Example:

macaron analyze -purl pkg:github.com/apache/maven

Provide PURL with repository path

This is used for the case where the user want to analyze a software component not being a git repository. The repository path is provided from the user to map with that software component.

Note that the branch name and the commit hash must be provide. This enforcement is to prevent Macaron mapping the software component with an incorrect repository snapshot.

Example:

macaron analyze -purl pkg:maven/apache/maven -rp https://github.com/apache/maven -b <branch_name> -d <commit_digest>

[benmss]

I have no further suggestions or comments for this PR. The only minor comments I could raise relate to the functions that will be moved into the Repo Finder as part of PR 388. I see no reason to discuss them here when that PR will change them anyway, and is blocked by this one.

[behnazh-w]

Suggested change

	Note that this method will be updated when there are new pre-defined type as per the PURL specification.
	Note that this method will be updated when there are new pre-defined types as per the PURL specification.

[tromai]

Fixed in f66b0be

[behnazh-w]

Suggested change

	The list bellow shows examples for the corresponding PURL string for different git repositories:
	The list bellow shows examples for the corresponding PURL strings for different git repositories:

[tromai]

Fixed in 229e039