Support for local and git dependencies

[GwendalLaurent]

This PR introduces support for handling local checkout dependencies (rebar3 _checkouts) and refactors the CPE and PURL generation logic to cover more dependency types and edge cases.

Changes

Local Dependencies

• Added support for checkout dependencies (dependencies found in _checkouts/).
• Introduced pkg:otp PURL type for local OTP application dependencies.
• Added pkg:generic PURL type for other local dependencies.

CPE Generation

• Refactored rebar3_sbom_cpe functions name. The previous names were too restrictive. (renamed function calls in rebar3_sbom_cpe_SUITE as well)
• Improved CPE generation for Git dependencies, now correctly handling tag, branch, and ref types.
• Added support for parsing SSH-style GitHub URLs (git@github.com:...) to correctly extract organization names for CPEs.

PURL Enhancements

• Added rebar3_sbom_purl:local_otp_app/2 and rebar3_sbom_purl:local/2 to support local OTP apps and local non-otp apps. See dataflow here for more details

Testing

• Added test/rebar3_sbom_purl_SUITE.erl to cover PURL generation for Hex, GitHub, Bitbucket, and local packages. This was lacking and adding rebar3_sbom_purl:local_otp_app/2 and rebar3_sbom_purl:local/2 made me add the SUITE.
• Added checkout_app_dependency_test to rebar3_sbom_json_SUITE to verify SBOM output for local checkout apps + corresponding local app in "test/local_app/_checkouts".

Note

I tried to add test cases for dependencies coming from GitHub but rebar3 seemed unable to fetch them during the initialization phase so I gave up. However, I tested them locally using a sandbox app and I can confirm that they are working.