Hint information for non OS packages

**What would you like to be added**:

I want Hint information for non OS packages.
`namespace` in `purl`, or something.

I have no goog idea.
`Maintainer` in deb. `Vendor` `Repository`, `From repo` in rpm may be datasouce.

Maybe, hardcoding for each product is required.

**Why is this needed**:

Following tools will be able to check CVE and EOL without individual own implementation.
If `namespace` in `purl` is not OS vendor, scanner can judge this will be non OS package.

For example, scan for nginx upstream packages will be improved.
And, nginx docker official image use upstream package.

**Additional context**:

In this time, let me focus `CVE-2021-23017`

In upstream ...
- `CVE-2021-23017` was fixed at `1.20.1` and `1.21.`.
[https://nginx\.org/en/CHANGES\-1\.20](https://nginx.org/en/CHANGES-1.20)
[https://nginx\.org/en/CHANGES\-1\.22](https://nginx.org/en/CHANGES-1.22)
- `Vulnerable: 0.6.18-1.20.0` is written in official information
[nginx security advisories](http://nginx.org/en/security_advisories.html)
- NVD shows `From (including) 0.6.18 - Up to (excluding) 1.20.1`
[NVD \- CVE\-2021\-23017](https://nvd.nist.gov/vuln/detail/CVE-2021-23017)

In debian package ...
- `CVE-2021-23017` was fixed at `1.14.2-2+deb10u4`, `1.14.2-2+deb10u5`, `1.18.0-6.1+deb11u3` , `1.22.1-6` and `1.22.1-7` in each release series.
[CVE\-2021\-23017](https://security-tracker.debian.org/tracker/CVE-2021-23017)

----

I prepared some images.

- debian 10 (buster) + 1.14.2-2+deb10u3 (OS apackage)
- debian 10 (buster) + 1.14.2-2+deb10u5 (OS ackage)
- debian 10 (buster) + 1.20.0-1 (upstream official package)
- debian 10 (buster) + 1.20.1-1 (upstream official package)

debian 10 (buster) + 1.14.2-2+deb10u3 (OS apackage)
no problem

```
$ syft -q ghcr.io/witchcraze/debian10_nginx1.14.2-2deb10u3_os | grep 'nginx '
nginx 1.14.2-2+deb10u3 deb

$ grype -q ghcr.io/witchcraze/debian10_nginx1.14.2-2deb10u3_os | grep 'nginx ' | grep 'CVE-2021-23017'
nginx 1.14.2-2+deb10u3 1.14.2-2+deb10u4 deb CVE-2021-23017 High
```

debian 10 (buster) + 1.14.2-2+deb10u5 (OS ackage)
no problem

```
$ syft -q ghcr.io/witchcraze/debian10_nginx1.14.2-2deb10u5_os | grep 'nginx '
nginx 1.14.2-2+deb10u5 deb

$ grype -q ghcr.io/witchcraze/debian10_nginx1.14.2-2deb10u5_os | grep 'nginx ' | grep 'CVE-2021-23017'
$
```

debian 10 (buster) + 1.20.0-1 (upstream official package)
**_`CVE-2021-23017` should be detected ..._**
If grype can judge this is non OS package, and use NVD data, `CVE-2021-23017` will be detected.

```
$ syft -q ghcr.io/witchcraze/debian10_nginx1.20.0-1_upstream | grep 'nginx '
nginx 1.20.0-1~buster deb

$ grype -q ghcr.io/witchcraze/debian10_nginx1.20.0-1_upstream | grep 'nginx ' | grep 'CVE-2021-23017'
$
```

----

Check package information

debian10 + OS package
```
# apt info nginx
Package: nginx
Version: 1.14.2-2+deb10u5
Priority: optional
Section: httpd
Maintainer: Debian Nginx Maintainers
Installed-Size: 100 kB
Depends: nginx-full (<< 1.14.2-2+deb10u5.1~) | nginx-light (<< 1.14.2-2+deb10u5.1~) | nginx-extras (<< 1.14.2-2+deb10u5.1~), nginx-full (>= 1.14.2-2+deb10u5) | nginx-light (>= 1.14.2-2+deb10u5) | nginx-extras (>= 1.14.2-2+deb10u5)
Homepage: https://nginx.net
Download-Size: 88.9 kB
APT-Sources: http://deb.debian.org/debian-security buster/updates/main amd64 Packages
Description: small, powerful, scalable web/proxy server
```

debian11 + OS package
```
# apt info nginx
Package: nginx
Version: 1.18.0-6.1+deb11u3
Priority: optional
Section: httpd
Maintainer: Debian Nginx Maintainers
Installed-Size: 104 kB
Depends: nginx-core (<< 1.18.0-6.1+deb11u3.1~) | nginx-full (<< 1.18.0-6.1+deb11u3.1~) | nginx-light (<< 1.18.0-6.1+deb11u3.1~) | nginx-extras (<< 1.18.0-6.1+deb11u3.1~), nginx-core (>= 1.18.0-6.1+deb11u3) | nginx-full (>= 1.18.0-6.1+deb11u3) | nginx-light (>= 1.18.0-6.1+deb11u3) | nginx-extras (>= 1.18.0-6.1+deb11u3)
Homepage: https://nginx.net
Tag: implemented-in::c, interface::daemon, network::server, network::service,
protocol::http, role::program, use::proxying
Download-Size: 92.9 kB
APT-Sources: http://deb.debian.org/debian bullseye/main amd64 Packages
Description: small, powerful, scalable web/proxy server
```

Debian 10 + upstream package
```
# apt info nginx
Package: nginx
Version: 1.22.0-1~buster
Priority: optional
Section: httpd
Maintainer: NGINX Packaging
Installed-Size: 3112 kB
Provides: httpd, nginx, nginx-r1.22.0
Depends: libc6 (>= 2.28), libpcre2-8-0 (>= 10.32), libssl1.1 (>= 1.1.1), zlib1g (>= 1:1.1.4), lsb-base (>= 3.0-6), adduser
Conflicts: nginx-common, nginx-core
Replaces: nginx-common, nginx-core
Homepage: https://nginx.org
Download-Size: 889 kB
APT-Sources: http://nginx.org/packages/debian buster/nginx amd64 Packages
Description: high performance web server
nginx [engine x] is an HTTP and reverse proxy server, as well as
a mail proxy server.
```

Rocky9 + OS Package
```
# yum info nginx
Last metadata expiration check: 0:03:35 ago on Thu Feb 23 09:02:02 2023.
Installed Packages
Name : nginx
Epoch : 1
Version : 1.20.1
Release : 13.el9
Architecture : x86_64
Size : 147 k
Source : nginx-1.20.1-13.el9.src.rpm
Repository : @System
From repo : appstream
Summary : A high performance web server and reverse proxy server
URL : https://nginx.org
License : BSD
Description : Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and
: IMAP protocols, with a strong focus on high concurrency, performance and low
: memory usage.

# rpm -qi nginx
Name : nginx
Epoch : 1
Version : 1.20.1
Release : 13.el9
Architecture: x86_64
Install Date: Thu Feb 23 09:03:54 2023
Group : Unspecified
Size : 150733
License : BSD
Signature : RSA/SHA256, Mon Oct 31 15:41:42 2022, Key ID 702d426d350d275d
Source RPM : nginx-1.20.1-13.el9.src.rpm
Build Date : Mon Oct 31 15:37:14 2022
Build Host : pb-f577e986-58a5-477f-8f44-92b933793d0b-b-x86-64
Packager : Rocky Linux Build System (Peridot)
Vendor : Rocky Enterprise Software Foundation
URL : https://nginx.org
Summary : A high performance web server and reverse proxy server
Description :
Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and
IMAP protocols, with a strong focus on high concurrency, performance and low
memory usage.
```

Start by reviewing how package metadata and purl values are represented for Debian and RPM packages, then trace the package data produced for the nginx examples. Done would require an agreed way to identify non-OS packages and expose hint information that enables the described CVE comparison.

Written by the indexing model from the issue text.