SBOM extractors should convert PURLs to the correct ecosystem

Currently SBOM extractors return the PURL type as the ecosystem which is incorrect, but instead should retrieve the proper ecosystem from the PURL string.

This includes parsing keys like `distro=alpine-3.17.2` to get the exact release version (though this is not finalised in the PURL standard.)

Start by locating the SBOM extractors and the logic that converts PURL strings into ecosystems. Check how keys such as `distro=alpine-3.17.2` are parsed, and consider the relevant PURL behavior. Done means extractors return the correct ecosystem and preserve the exact distro release version where applicable.

Written by the indexing model from the issue text.