Incorrect purls reported for bundled code in package scan

Package scan for `next-14.2.26` is correctly reported as `pkg:npm/next@14.2.26` . However, all the sub-packages (bundled code) are also reported as `pkg:npm/next@14.2.26` which may not be correct.

input: https://www.npmjs.com/package/next/v/14.2.26?activeTab=code

For instance,

```
{
"path": "code/next-14.2.26.tgz-extract/package/dist/compiled/@edge-runtime/primitives/fetch.js.text.js",
"type": "file",
"package_data": [],
"for_packages": [
"pkg:npm/next@14.2.26?uuid=44b2abd3-413c-432f-88e5-dc1cd843855b"
],
"scan_errors": []
},
```
The `for_packages` should be: `pkg:npm/@edge-runtime/primitives`

```
{
"path": "code/next-14.2.26.tgz-extract/package/dist/compiled/@ampproject/toolbox-optimizer/index.js",
"type": "file",
"package_data": [],
"for_packages": [
"pkg:npm/next@14.2.26?uuid=44b2abd3-413c-432f-88e5-dc1cd843855b"
],
"scan_errors": []
},
```
The `for_packages` should be: `pkg:npm/@ampproject/toolbox-optimizer`