add PURLs when scanning Gradle lock files (#2278)

This adds PURLs when scanning Gradle lock files.

Unintuitively the correct PURL type appears to be `maven` as opposed to
`gradle`. See https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst

- `gradle` for Gradle plugins
- `maven` for Maven JARs and related artifacts

Signed-off-by: Robbie Vanbrabant <robbie@monzo.com>

syft/pkg/cataloger/java/parse_gradle_lockfile.go

@@ -46,8 +46,18 @@ func parseGradleLockfile(_ file.Resolver, _ *generic.Environment, reader file.Lo
 			dependencies = append(dependencies, dep)
 		}
 	}
+
 	// map the dependencies
 	for _, dep := range dependencies {
+		archive := pkg.JavaArchive{
+			PomProject: &pkg.JavaPomProject{
+				GroupID:    dep.Group,
+				ArtifactID: dep.Name,
+				Version:    dep.Version,
+				Name:       dep.Name,
+			},
+		}
+
 		mappedPkg := pkg.Package{
 			Name:    dep.Name,
 			Version: dep.Version,
@@ -56,14 +66,8 @@ func parseGradleLockfile(_ file.Resolver, _ *generic.Environment, reader file.Lo
 			),
 			Language: pkg.Java,
 			Type:     pkg.JavaPkg,
-			Metadata: pkg.JavaArchive{
-				PomProject: &pkg.JavaPomProject{
-					GroupID:    dep.Group,
-					ArtifactID: dep.Name,
-					Version:    dep.Version,
-					Name:       dep.Name,
-				},
-			},
+			PURL:     packageURL(dep.Name, dep.Version, archive),
+			Metadata: archive,
 		}
 		mappedPkg.SetID()
 		pkgs = append(pkgs, mappedPkg)