Add proper qualifier to purl for directly downloaded pods

[jgongo]

According to the CocoaPods Podfile guide, pods can be directly downloaded using one of the following mechanisms:

• Using files from a local path: :path
• From a podspec in the root of a library repository: :git possibly adding :branch, :tag or :commit
• From a podspec outside a spec repository: :podspec

These cases should be taken into account when generating the purl for the dependency, using download_url/vcs_url as specified in the purl specification

For each of these cases, the following should be decided:

• Whether to include the dependency in the generated BOM or not: for example, does it make sense to include a dependency to a local pod (:path) taking into account that any other software processing the BOM won't probably have access to that pod?
• Format of the URL:
  • :path is usually specified with a plain path, not a URL. If we implement this, should we make sure this is a file: URL?
  • Is there any standard for git URLs including both source repository and a location in that repository (branch, tag or commit)?
  • Must we validate somehow the URL used in :podspec or can we trust the URL is valid if CocoaPods was already able to download it?

[jgongo]

Related to package-url/purl-spec#103

[macblazer]

It was pointed out in package-url/purl-spec#103 that direct :git references should use the vcs_url qualifier on the pod's purl instead of the download_url qualifier.

[jgongo]

After a bit of research:

• :git dependencies should use vcs_url (as mentioned by @macblazer) using the SPDX format
• :podspec dependencies should probably use download_url
• :path dependencies should probably be ignored, but it must be confirmed

[jgongo]

Fixed by #7