Query API ignores purl qualifiers

**Describe the bug**
The OSV API does not respect the distro qualifier when querying with a purl, potentially leading to false positive vulnerability reports. Specifically, this leads to false positives in [GUAC](https://github.com/guacsec/guac) when using the OSV certifier.

**To Reproduce**
Using the sample package `busybox` in version `1.36.1-r19` from Alpine 3.19.

Query the OSV API using a purl:
```bash
curl -d '{"package": { "purl": "pkg:apk/alpine/busybox@1.36.1-r19?distro=alpine-3.19" } }' https://api.osv.dev/v1/query
```
Pipe through jq to only show relevant parts:
```bash
jq '.vulns[] | {id: .id, affected: (.affected[]? | select(has("package") and .package.ecosystem == "Alpine:v3.19" and .package.name == "busybox") | {ecosystem: .package.ecosystem, fixed_version: .ranges[].events[] | select(has("fixed")).fixed})}'
```

The result is:

```bash
{
"id": "CVE-2023-42363",
"affected": {
"ecosystem": "Alpine:v3.19",
"fixed_version": "1.36.1-r17"
}
}
{
"id": "CVE-2023-42364",
"affected": {
"ecosystem": "Alpine:v3.19",
"fixed_version": "1.36.1-r19"
}
}
{
"id": "CVE-2023-42365",
"affected": {
"ecosystem": "Alpine:v3.19",
"fixed_version": "1.36.1-r19"
}
}
{
"id": "CVE-2023-42366",
"affected": {
"ecosystem": "Alpine:v3.19",
"fixed_version": "1.36.1-r16"
}
}
```
The CVEs listed do not affect the queried version in Alpine 3.19, but do affect this version in Alpine 3.20 and 3.21

When Querying with `name`, `ecosystem` and `version` instead of a purl:
`curl -d '{"package": { "name": "busybox", "ecosystem": "Alpine:v3.19" }, "version": "1.36.1-r19" }' https://api.osv.dev/v1/query`
The API returns no results, as expected.

**Additional context**
Looking at https://github.com/google/osv.dev/blob/master/osv/purl_helpers.py reveals, that purl qualifiers are disregarded entirely after parsing.
While the `distro` qualifier is not properly standardized (see https://github.com/package-url/purl-spec/issues/247), I think this should be considered.