fix(purl): preserve Packagist repository URLs

[kappa9999]

Overview

Preserve non-default Packagist repositories when converting between OSV ecosystems and Package URLs.

Fixes #5683

Details

The active Go PURL registry treated Packagist as a generic slash-separated ecosystem. That preserved the Composer namespace and package name, but discarded the repository suffix from ecosystems such as Packagist:https://packages.drupal.org/8. The reverse parser likewise ignored the repository_url qualifier.

This change:

• registers a dedicated Packagist generator/parser;
• writes the ecosystem suffix as the standard repository_url qualifier;
• restores that qualifier to the OSV ecosystem during PURL parsing;
• keeps unqualified Packagist behavior unchanged; and
• relies on packageurl-go for canonical qualifier escaping.

The production worker enrichment path has a focused Drupal regression case, and the PURL package has a generation/parse round-trip test.

Testing

$ cd go
$ go test ./purl ./internal/worker/pipeline/purl
ok  github.com/google/osv.dev/go/purl
ok  github.com/google/osv.dev/go/internal/worker/pipeline/purl

gofmt -d reports no differences for the changed Go files.

AI-assisted contribution: Codex was used for code and test drafting, repository inspection, diff review, and local validation.

[michaelkedar]

/gcbrun

[michaelkedar]

Looks good, thanks