encode upstream qualifier on os package pURLs (#769)

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

syft/pkg/url.go

@@ -14,7 +14,10 @@ const (
 	purlArchQualifier   = "arch"
 	purlDistroQualifier = "distro"
 	purlEpochQualifier  = "epoch"
-	purlVCSURL          = "vcs_url"
+	purlVCSURLQualifier = "vcs_url"
+
+	// this qualifier is not in the pURL spec, but is used by grype to perform indirect matching based on source information
+	purlUpstreamQualifier = "upstream"
 )
 
 type urlIdentifier interface {