CPEs generated for Jenkins plugins should have a target software and correct vendor

The CPE dictionary shows a trend where jenkins plugins have a target software of "jenkins" https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=jenkins . ~We already make certain that jenkins plugins do not get a vendor value of "jenkins" to distinguish it from the jenkins project~ (edit: [no we don't](https://github.com/anchore/syft/pull/1982)), however, we could be crafting more accurate CPEs for plugins as well.

For some examples check out https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=jenkins :
- [`cpe:2.3:a:eficode:influxdb:1.8:*:*:*:*:jenkins:*:*`](https://nvd.nist.gov/products/cpe/detail/439757?namingFormat=2.3&orderBy=CPEURI&keyword=jenkins&status=FINAL)
- [`cpe:2.3:a:gitea:gitea:1.2.0:*:*:*:*:jenkins:*:*`](https://nvd.nist.gov/products/cpe/detail/1293333?namingFormat=2.3&orderBy=CPEURI&keyword=jenkins&status=FINAL)

developer note: the adjustment can be applied somewhere around https://github.com/anchore/syft/blob/e2f7befbfbf88053dfb2007c6499a4bb2d232c3c/syft/pkg/cataloger/common/cpe/generate.go#L180 most likely

Start in syft/pkg/cataloger/common/cpe/generate.go around line 180 and compare the generated Jenkins plugin CPEs with the NVD examples linked in the issue. Trace how vendor and target software are selected; done means Jenkins plugin CPEs use the correct vendor and identify Jenkins as their target software.

Written by the indexing model from the issue text.