[FR]: Imported libraries should advertise in their tags where they came from

### What is the current behavior?

_No response_

### Describe the feature

Both `rules_jvm_external` and `rules_python` add metadata to libraries created from imported third party dependencies that allow users to track where those dependencies come from. It would be helpful if `rules_js` did the same thing. This is useful when creating SBOMs, but also for just getting some insight into what a build actually depends on.

The metadata is typically stored in the `tags` of the targets generated from the imported dependencies. It would be nice if `rules_js` also provided this kind of information for dependencies imported via NPM or Yarn.

The kinds of metadata that are useful include: the name of the dependency in the third party system (eg. for Java these are the Maven coordinates, but for Python it's the module name in Pypi. I would imagine the dependency name would be enough), and the version being used. If we could also know the server from which the dependency was downloaded and the sha of the file, that would be really helpful. Ideally, there would be enough information to construct a proper [NPM PURL](https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#npm)

### Fund our work

- [ ] Sponsor our open source work by donating a [feature bounty](https://opencollective.com/aspect-build/)

No files or tests are named. Start by comparing the metadata behavior described for rules_jvm_external and rules_python with the NPM and Yarn dependency handling in rules_js; done should provide dependency tags containing enough information to identify the package and version, and ideally construct an NPM PURL with source and file SHA details.

Written by the indexing model from the issue text.