PRP: Extractor for Jenkins CI Plugins

- **Software distribution method or binary type**: .hpi .jpi (Jenkins plugin archives)

- **Popularity of distribution method**: Jenkins is one of the most widely used CI/CD platforms. The official ecosystem contains +2000 plugins, most Jenkins instances rely on dozens of plugins, resulting in a very large and widely deployed plugin distribution surface across enterprises, cloud environments, and open source projects.

- **Any critical, emergent vulnerability associated with software from the distribution method**: Jenkins plugins have a long history of critical vulnerabilities including Remote Code Execution (RCE), arbitrary file read/write, credential leakage, deserialization issues, and sandbox bypasses. Many security advisories specifically target plugins rather than Jenkins core, making plugin visibility essential for vulnerability detection. Vulnerabilities are tracked by osv.dev under packages `Maven/org.jenkins-ci.plugins:` and also by Jenkins Organization. Currently osv-scalibr is able to read the jpi package as a java/archive and identify internal dependencies, but it is not possible to know if the plugin itself is running a vulnerable version.

- **Resources**:
* https://plugins.jenkins.io/
* https://www.jenkins.io/security/advisories/
* https://osv.dev/vulnerability/GHSA-p9hg-wrmv-v8cp

- **Sample Plugin Manifest**:

```
Manifest-Version: 1.0
Created-By: Maven Archiver 3.5.2
Build-Jdk-Spec: 17
Short-Name: loadninja
Long-Name: LoadNinja Plugin
Url: https://wiki.jenkins.io/display/JENKINS/LoadNinja+Plugin
Plugin-Version: 2.2
...
```

Should emit the following PURL

```
pkg:maven/org.jenkins-ci.plugins/loadninja@2.2
```