Inconsistency in packageurl-go for docker and OCI PURLs

[pxp928]

Docker and OCI PURLs are potentially not well specified due to the namespace indicating it may contain a registry but the use of repository_url in the examples. In addition, the versions used in the examples use tags and potentially indicate truncated hashes.

There is an issue converting the purl into a graphQL package node and the package node back to a purl.

See purl_test.go for examples of these inconsistencies in the unit tests as well as comments

There is also an issue of url path escapes:
Example Purl: pkg:generic/openssl@1.1.10g?download_url=https:%2F%2Fopenssl.org%2Fsource%2Fopenssl-1.1.0g.tar.gz&checksum=sha256:de4d501267da

Need to determine how this affects OCI certifier and potentially deps.dev queries?

[pxp928]

release of https://github.com/package-url/packageurl-go/releases/tag/v0.1.2 fixes these issues.

see: package-url/packageurl-go#52, package-url/packageurl-go#55 and package-url/packageurl-go#58