feat!: (re)move non-standard implementations

This library claims to implement the CycloneDX standard. And it doe.

but it also has some implementation parts that are not standard - they should be moved to the "contrib" area, or removed entirely.

## Goal
- [ ] move helpers/factories/builders to the "contrib" area
- #916
- remove the (old) deprecated exports
- remove the usage of external models
- [ ] `Compoennt.purl` is no longer an instance of `PackageUrl` but a simple `str` or instance of string-castable
- cast to string on normalization
- downstream users can still use a PackageURL object, if needed ....
- remove `packageurl` dependency
- #939
- [ ] validation of external standards -like SPDX expressios and such...
- [ ] don't use UUID for `bom.serailNumber` - this is a string ...
- tbc...

## Motivation:
- have a clean standard implementation, no opinionated fluff, only models and (de)serailization.

The issue covers helpers, factories, builders, deprecated exports, Component.purl, the packageurl dependency, SPDX-like validation, and bom.serialNumber. Start by inventorying those areas and reviewing linked issues #916 and #939. Done means the non-standard implementations are moved or removed and the remaining models and serialization stay aligned with the stated standard.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.