Drop dependency on `packageurl-java`

The library is used in a single setter in the `Component` class:

https://github.com/CycloneDX/cyclonedx-core-java/blob/d7dad57853e494a150fc09e31a044856d62fffd8/src/main/java/org/cyclonedx/model/Component.java#L451-L453

Which is purely cosmetic and provides little value.

OTOH, it binds consumers of this library to a specific major version of `packageurl-java`.
We should keep our dependency footprint slim to only what's needed.

This would be a breaking change because the setter shown above is public.

Start in src/main/java/org/cyclonedx/model/Component.java at the setter around lines 451–453, then search the project for other packageurl-java references and the dependency declaration. Confirm the cosmetic behavior is isolated and check the public API impact. Done means the dependency and its unused API usage are removed consistently, with relevant tests or builds passing.

Written by the indexing model from the issue text.