Add status or details for package

When I see a package in a scan, I would like to know where we got it from.
- Was it obtained from a scan of the code?
- Or was it matched to the purlDB? and which one?
- Or was it found from mapped file to corresponding source code in a d2d pipeline?
- Or does it come from some other procedure (like a dependency resolution)
- It this a skiny, partial package (with only PURL data?) or more a more comprehensive set of metadata?
- Or does it come from a curated ABOUT file or some other curated data source?