feat: account yarn's applied "compat" patches in SBOM results

## Describe the ~~bug~~ feature

Yarn's builtin [@yarnpkg/plugin-compat](https://github.com/yarnpkg/berry/tree/master/packages/plugin-compat) will automatically patch specific packages upon install. As far as I can see, this is not reflected in the created SBOM.

## To Reproduce

```
# yarn add resolve
➤ YN0000: · Yarn 4.5.1
➤ YN0000: ┌ Resolution step
➤ YN0085: │ + resolve@patch:resolve@npm%3A1.22.8#optional!builtin::version=1.22.8&hash=c3c19d, function-bind@npm:1.1.2, hasown@npm:2.0.2, is-core-module@npm:2.15.1, path-parse@npm:1.0.7, resolve@npm:1.22.8, supports-preserve-symlinks-flag@npm:1.0.0
➤ YN0000: └ Completed
[...]
~# yarn info --name-only
├─ resolve@patch:resolve@npm%3A1.22.8#optional!builtin::version=1.22.8&hash=c3c19d
[...]
# yarn dlx -q @cyclonedx/yarn-plugin-cyclonedx
[...]
"components": [
{
"type": "library",
"name": "resolve",
"version": "1.22.8",
"bom-ref": "resolve@patch:resolve@npm%3A1.22.8#optional!builtin::version=1.22.8&hash=c3c19d",
"author": "James Halliday",
"description": "resolve like require.resolve() on behalf of files asynchronously and synchronously",
"purl": "pkg:npm/resolve@1.22.8?vcs_url=git%3A//github.com/browserify/resolve.git",
[...]
```

So the only trace of the patch you see in the SBOM is the `bom-ref` which should be opaque to BOM consumers, I guess.

Looking at the version and purl, you would assume that an unchanged resolve as available from NPM is in your system while in fact, [this patch](https://github.com/yarnpkg/berry/blob/master/packages/plugin-compat/sources/patches/resolve.patch.ts) ([readable version](https://github.com/browserify/resolve/pull/174)) was applied to it.

## Expected behavior

To be honest, I'm unsure whether the information should be better provided using [`pedigree/patches`](https://cyclonedx.org/docs/1.6/json/#components_items_pedigree_patches), using something like `1.22.8&hash=c2c19d` as `version` ... or if this would even justify to extend the purl specification...

## Environment

Tested on:
- _@cyclonedx/yarn-plugin-cyclonedx_ version: 1.0.2+git.4f6eb7e
- yarn version: 4.5.1
- Node version: 23.0.0
- OS: `docker pull node:23-bookworm`