feat(sbom): use group field for jar in cyclonedx

[DmitriyLewen]

Description

Maven and Gradle CycloneDX plugins use Group field for GroupID.
#4669
#4635

We need to add support of this case.
Also split GroupID and ArtifactID by group and name fields.

Related Issues

• Close use Group field for jar in Cyclonedx #4675

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

I think it should be done here. What do you think?

trivy/pkg/purl/purl.go

Lines 73 to 85 in df61fd4

	if p.Type == packageurl.TypeMaven || p.Type == ftypes.Gradle {
	// Maven and Gradle packages separate ":"
	// e.g. org.springframework:spring-core
	pkg.Name = strings.Join([]string{
	p.Namespace,
	p.Name,
	}, ":")
	} else {
	pkg.Name = strings.Join([]string{
	p.Namespace,
	p.Name,
	}, "/")
	}

[knqyf263]

Or is PURL missing groupID?

[DmitriyLewen]

we use component.Name after this PR - https://github.com/aquasecurity/trivy/pull/4306/files#diff-caf585364b1a95f5cb5dbda210a5ca931fad058915ba586540c8aa32a7883311R346

But maybe it's better to use the purl name for jars. Wdyt?

[knqyf263]

Oh, I just remember the change. OK, so we can go with your change.