Parse runs packageurl-go's Normalize (per-type lowercasing, PyPI
underscore-to-dash, etc) but New and the string-builder helpers did not,
so pkg:pypi/Django and pkg:pypi/django were treated as distinct depending
on which entry point produced them.

New now calls Normalize on the constructed struct. MakePURLString and
BuildPURLString run the same normalization on a stack-allocated struct
before the fast string builder, passing repository_url through so
registry-dependent rules (mlflow) apply. Normalize errors are discarded
and whatever fields it wrote are kept, so New and the string path stay in
step even for inputs that fail per-type validation.

Fixes #21