SPDX JSON created should contain a lowercase `PURL` key

While the SPDX spec is not mandating lowercase field names (or is explicit about case sensitivity), generally _all_ fields in the spec are written in lowercase.

This is also the case for the [`purl`](https://spdx.github.io/spdx-spec/v2.3/external-repository-identifiers/#f35-purl) field, which is currently blocking SPDX files generated by `sbom-tool` to be ingested by downstream tooling.

Let's ensure the field names generated by this tool are all lowercased to ensure maximum compatibility.

(for reference, `cdxgen` does this correctly).

cc @mcombuechen