JSON output doesn't include purls for scanned packages

The `--format=json` output describes each scanned package with just name, version and ecosystem:

```json
"package": {
"name": "lodash",
"version": "4.18.1",
"ecosystem": "npm"
}
```

When I need a purl I have to rebuild it by hand from name, ecosystem and version, which is tedious and easy to get wrong. The advisories in the same output already use purls (`affected[].package.purl`).

So I'd add an optional field:

```json
"package": {
"name": "lodash",
"version": "4.18.1",
"ecosystem": "npm",
"purl": "pkg:npm/lodash@4.18.1"
}
```

With `omitempty`, packages without a purl (git commits, for example) just keep their current shape, like the recently added `deprecated` field.

Happy to open a PR. It's one new field on `models.PackageInfo`.