CPE generation for PHP packages are not correct

**What happened**:
CPEs for the `symfony/translation` package result in:
```json
"cpes": [
"cpe:2.3:a:symfony\\/translation:symfony\\/translation:v4.4.2:*:*:*:*:*:*:*"
],
```

**What you expected to happen**:
Should have resulted in something closer to:
```json
"cpes": [
"cpe:2.3:a:symfony:translation:v4.4.2:*:*:*:*:*:*:*"
],
```

Reproduce the reported CPE for the PHP package symfony/translation and trace where its package name is split into vendor and product fields. Done means the generated CPE uses symfony:translation rather than the escaped symfony\/translation value, with coverage for this case.

Written by the indexing model from the issue text.