CDX SBOM output appends &uuid to the purl field

[mjherzog]

Describe the bug
All version of the CDX SBOM (1.4, 1.5, 1.6) output from SCIO append the package_uid from a Scan to the purl - an example is: pkg:deb/ubuntu/libkrb5support0@1.17-6ubuntu4.4?arch=amd64&uuid=3ee6bb6c-8a74-470c-900b-378f48e70b70. The same value is used for bom-ref and in the dependsOn section of the SBOM.
This format probably makes sense for the bom-ref field, but it is a bug for the purl field because it is an internal "document" reference. I am not sure about the dependency information.
I do not see this bug in the SPDX output.

System configuration

• Which version of ScanCode.io are you running? v34.4.0
• Are you running the app using Docker? Yes

Expected behavior
SCIO should report a correct purl for a package without scan-specific data.

[DennisClark]

See the Project sh-ubuntu1-docker on Staging SCIO for a good example. When you view the Packages in the SCIO UI, there is no uuid at the end of the purl, but a generated CDX SBOM appends one at the end of the purl for each package.

[DennisClark]

Also if you download the (very large) scan results of sh-ubuntu1-docker to xlsx or json, the purl values are what you might expect, without the appended uuid value.

[tdruez]

There was a bug where the bom_ref value was also used to set the package_url field in the CycloneDX output.
Fixed in #1225