feat!: (re)move non-standard implementations

This library claims to implement the CycloneDX standard. And it doe.

but it also has some implementation parts that are not standard - they should be moved to the "contrib" area, or removed entirely.

## Goal
- [ ] move helpers/factories/builders to the "contrib" area
- #916
- remove the (old) deprecated exports
- remove the usage of external models
- [ ] `Compoennt.purl` is no longer an instance of `PackageUrl` but a simple `str` or instance of string-castable
- cast to string on normalization
- downstream users can still use a PackageURL object, if needed ....
- remove `packageurl` dependency
- #939
- [ ] validation of external standards -like SPDX expressios and such...
- [ ] don't use UUID for `bom.serailNumber` - this is a string ...
- tbc...

## Motivation:
- have a clean standard implementation, no opinionated fluff, only models and (de)serailization.

该 issue 涵盖 helpers、factories、builders、已弃用的 exports、Component.purl、packageurl 依赖、类似 SPDX 的验证以及 bom.serialNumber。首先盘点这些领域，并审查关联的 issues #916 和 #939。当非标准实现被迁移或移除，且剩余模型和序列化仍与所述标准保持一致时，即表示完成。

由索引模型根据 Issue 内容生成。