pip cataloger should support repository url

**What would you like to be added**:

when pip packages are installed from non default pip indices (pypi), we should store the pip repository url in the sbom

**Why is this needed**: useful to know the origin of a package

**Additional context**:

Start by locating Syft's pip cataloger and the SBOM package metadata it produces, then trace how packages from non-default pip indices are identified. Confirm where a repository URL can be represented in the generated SBOM and review existing cataloger tests or fixtures. Done means the originating pip repository URL is retained for packages installed from non-default indices.

Written by the indexing model from the issue text.