wrong Group ID for spring-security-crypto component

**What happened**:

sbom created by syft have wrong referenceLocator:
for component:
```
"SPDXID": "SPDXRef-cdd9f48bc759acd2",
"name": "spring-security-crypto",
"licenseConcluded": "NONE",
"downloadLocation": "NOASSERTION"
```
i'm geting `"externalRefs"`:
```
"referenceCategory": "PACKAGE_MANAGER",
"referenceLocator": "pkg:maven/spring-security-crypto/spring-security-crypto@5.8.16",
"referenceType": "purl"
```
where correct Maven package format should be:
`pkg:maven/org.springframework.security/spring-security-crypto@5.8.16`

so Group ID section is not correct:
`spring-security-crypto`
and should be:
`org.springframework.security`

**Anything else we need to know?**:
nope

**Environment**:
- Output of `syft version`: latest
- OS (e.g: `cat /etc/os-release` or similar): alma8.10

Reproduce the SBOM output for the spring-security-crypto component with Syft latest and inspect how its Maven package metadata is resolved. The issue is done when the generated purl uses org.springframework.security/spring-security-crypto@5.8.16 rather than spring-security-crypto/spring-security-crypto@5.8.16.

Written by the indexing model from the issue text.