Integrate with package_metadata

This module should allow us to add a purl (or some other templating mechanism to prevent duplication such as the version) to be able to integrate with https://github.com/bazel-contrib/supply-chain/tree/main/docs/metadata#as-module-author

It should also add provenance qualifiers to the PURL as defined in the [common qualifiers](https://github.com/package-url/purl-spec/blob/main/docs/common-qualifiers.md)

The goal is to be able to report what is used in a given artifact

Start by reading the package_metadata integration guidance and the package-url common qualifiers specification linked in the issue. Identify the module entry point that emits artifact metadata, then determine how a purl or templating mechanism can avoid duplicated version data. Done means artifacts report their usage with provenance qualifiers in the expected purl metadata.

Written by the indexing model from the issue text.