Support for specifying alias as part of purl

[prabhu]

When a package gets renamed (new namespace or name or both), it would be nice to specify the old names as an alias to allow downstream tools to link and maintain history.

Example:

Assume a package @appthreat/cdxgen @ 0.9.0 gets migrated to @cyclonedx/cdxgen @ 1.0.0 from version 1.0.0 onwards

Currently, these would create separate purls without a definitive way of linking them.

pkg:npm/%40appthreat/cdxgen@0.9.0
pkg:npm/%40cyclonedx/cdxgen@1.0.0

Under the proposal, the new purl could retain the aliases in encoded forms.

Example 1: Single alias

Node.js code snippet for encode

> encodeURIComponent("pkg:npm/@appthreat/cdxgen@1.0.0")
'pkg%3Anpm%2F%40appthreat%2Fcdxgen%401.0.0'

package URL example with a single alias

pkg:npm/%40cyclonedx/cdxgen@1.0.0?alias=pkg%3Anpm%2F%40appthreat%2Fcdxgen%401.0.0

Example 2: Multiple aliases (appthreat/cdxgen was originally prabhu/cdxgen)

pkg:npm/%40cyclonedx/cdxgen@1.0.0?alias=pkg%3Anpm%2F%40appthreat%2Fcdxgen%401.0.0&alias=pkg%3Anpm%2F%40prabhu%2Fcdxgen%401.0.0