Add new add-on pipeline to "enrich" packages with the PurlDB

[pombredanne]

Given detected, uploaded, inspected or resolved packages, I would like to have a way to "enrich" the packages with the PurlDB data. This would imply:

• getting enhanced package data from the PurlDB for the PURLs in my project
• running on-demand data collection for the PURLs that do not exist yet in the PurlDB

[tdruez]

Open for discussion:

• I have a pkg:pypi/pytest discovered package (no version), the collect endpoint returns /api/collect/?purl=pkg:pypi/pytest return 123 entries. None is the empty version entry.

[tdruez]

Following a discussion with @pombredanne, when calling the /api/collect/ from the enrich pipeline:

• If an error (500, timeout) is raised: Log this as a project error.
• If a single package entry is returned, set all the values on the discovered package instance.
• If multple package entries are returned, set only a subset of non-version specific fields (exclude download URL for example) and log a warning message on the project.

[tdruez]

The new enrich_with_purldb was merged and is now available. It leverages the PurlDB collect endpoint.
One improvement for this pipeline would be to add multiprocessing for the PurlDB requests, but before adding this layer of complexity, let's get some mileage of the current implementation.

[tdruez]

See also aboutcode-org/purldb#513