feat: Record where CPEs come from (#2552)

Syft can get CPEs from several source, including generating them based on
package data, finding them in the NVD CPE dictionary, or finding them declared
in a manifest or existing SBOM. Record where Syft got CPEs so that consumers of
SBOMs can reason about how trustworthy they are.

Signed-off-by: Will Murphy <will.murphy@anchore.com>

syft/format/internal/spdxutil/helpers/external_refs.go

@@ -10,7 +10,7 @@ func ExternalRefs(p pkg.Package) (externalRefs []ExternalRef) {
 	for _, c := range p.CPEs {
 		externalRefs = append(externalRefs, ExternalRef{
 			ReferenceCategory: SecurityReferenceCategory,
-			ReferenceLocator:  c.String(),
+			ReferenceLocator:  c.Attributes.String(),
 			ReferenceType:     Cpe23ExternalRefType,
 		})
 	}

syft/format/internal/spdxutil/helpers/external_refs_test.go

@@ -10,7 +10,7 @@ import (
 )
 
 func Test_ExternalRefs(t *testing.T) {
-	testCPE := cpe.Must("cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*")
+	testCPE := cpe.Must("cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*", cpe.Source(""))
 	tests := []struct {
 		name     string
 		input    pkg.Package
@@ -27,7 +27,7 @@ func Test_ExternalRefs(t *testing.T) {
 			expected: []ExternalRef{
 				{
 					ReferenceCategory: SecurityReferenceCategory,
-					ReferenceLocator:  testCPE.String(),
+					ReferenceLocator:  testCPE.Attributes.String(),
 					ReferenceType:     Cpe23ExternalRefType,
 				},
 				{