[BUG]: SRPM purl shows arch=x86_64 instead of arch=src for source RPMs

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Current Behavior

When generating an SBOM for a source RPM using `--rpm-package-hash`, the `purl` field contains `arch=x86_64` (the build machine architecture) instead of `arch=src`:

```
"purl": "pkg:rpm/almalinux/NetworkManager@1.54.0-2.el10_1?arch=x86_64&distro=almalinux-10&epoch=1"
```

The `almalinux:package:arch` property in the SBOM output also incorrectly shows `x86_64`.

This appears to be caused by the immudb metadata storing `"arch": "x86_64"` for source RPM records, even though `"build_arch": "src"` is correct in the same record. The alma-sbom tool trusts the `arch` field from immudb verbatim (in `DataProcessor02.get_package()`), so the wrong value propagates into the purl.

### Expected Behavior

For source RPMs, the purl should use `arch=src`, consistent with the [Red Hat PURL guidelines](https://redhatproductsecurity.github.io/security-data-guidelines/purl/):

> If a purl identifies a Source RPM (SRPM), the `arch` qualifier **must** use the special value `src`.

Expected output:

```
"purl": "pkg:rpm/almalinux/NetworkManager@1.54.0-2.el10_1?arch=src&distro=almalinux-10&epoch=1"
```

### Steps To Reproduce

1. Install alma-sbom (v0.0.2):

```bash
pip install git+https://github.com/AlmaLinux/alma-sbom.git
```

2. Query the SBOM for the `NetworkManager-1.54.0-2.el10_1.src.rpm` source RPM by hash:

```bash
alma-sbom --verbose --file-format cyclonedx-json package \
--rpm-package-hash 176763e560c8202e4360de64145814f0e79f33cd7bfabddd2c55d6e34cbf710c
```

3. Observe the purl in the output contains `arch=x86_64` instead of `arch=src`.

### Anything else?

### Root cause analysis

The raw immudb record for this hash shows the inconsistency:

```json
{
"Name": "NetworkManager-1.54.0-2.el10_1.src.rpm",
"Metadata": {
"sbom_api_ver": "0.2",
"build_arch": "src",
"arch": "x86_64",
"sourcerpm": null,
"name": "NetworkManager",
"epoch": 1,
"version": "1.54.0",
"release": "2.el10_1"
}
}
```

- `Name` correctly ends in `.src.rpm`
- `build_arch` is correctly `src`
- `arch` is incorrectly `x86_64` (the builder machine's architecture)
- `sourcerpm` is `null` (correct for a source RPM — it has no parent SRPM)

The bug has two layers:

1. **ALBS (primary):** The build system notarization stores the builder's architecture (`x86_64`) in the `arch` metadata field instead of `src` for source RPMs.
2. **alma-sbom (defensive):** `DataProcessor02.get_package()` in `alma_sbom/data/collectors/immudb/processor/apiver02.py` reads `arch` directly from immudb metadata with no validation. When `build_arch == "src"` or `Name` ends with `.src.rpm`, the `arch` field could be overridden to `src` as a defensive workaround.

### Suggested fix in alma-sbom

In both `DataProcessor01` and `DataProcessor02`, after constructing `PackageNevra`, check if `build_arch == 'src'` or `Name` ends with `.src.rpm`, and if so, set `arch = 'src'`. This corrects existing bad data without waiting for ALBS re-notarization.

### Reference

- [Red Hat PURL guidelines for RPM arch](https://redhatproductsecurity.github.io/security-data-guidelines/purl/) — specifies `arch=src` for SRPMs
- [purl-spec RPM type](https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#rpm)

### Search terms

arch src purl srpm source rpm x86_64 build_arch