Manage release/component by purl(package-url)

[KoukiHama]

(Some comments are in slack)

https://github.com/package-url
https://github.com/package-url/purl-spec

Package-url is helpful for handle with OSS component. It is able to distinguish OSS component by specific rules.

However, we need to bear in mind this @mcjaeger note.

But interesting: some software aftefacts can have multiple valid purl, because they appear in multiple package management systems

And this enhancement is related #115 (comment)
Cpe id will go external id.