Rename syft-id to package-id (#970)

Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>

internal/formats/common/cyclonedxhelpers/component.go

@@ -50,7 +50,7 @@ func deriveBomRef(p pkg.Package) string {
 	// TODO: In the future we may want to dedupe by PURL and combine components with
 	// the same PURL while preserving their unique metadata.
 	if parsedPURL, err := packageurl.FromString(p.PURL); err == nil {
-		parsedPURL.Qualifiers = append(parsedPURL.Qualifiers, packageurl.Qualifier{Key: "syft-id", Value: string(p.ID())})
+		parsedPURL.Qualifiers = append(parsedPURL.Qualifiers, packageurl.Qualifier{Key: "package-id", Value: string(p.ID())})
 		return parsedPURL.ToString()
 	}
 	// fallback is to use strictly the ID if there is no valid pURL

internal/formats/common/cyclonedxhelpers/component_test.go

@@ -171,7 +171,7 @@ func Test_deriveBomRef(t *testing.T) {
 		{
 			name: "use pURL-id hybrid",
 			pkg:  pkgWithPurl,
-			want: fmt.Sprintf("pkg:pypi/django@1.11.1?syft-id=%s", pkgWithPurl.ID()),
+			want: fmt.Sprintf("pkg:pypi/django@1.11.1?package-id=%s", pkgWithPurl.ID()),
 		},
 		{
 			name: "fallback to ID when pURL is invalid",