Use `SPDX` download location to determine package registry

[ejortega]

This uses the download location to match with known package registries for packages without an external ref.

Closes https://github.com/phylum-dev/cli/issues/1384

Checklist

• [x] Does this PR have an associated issue (i.e., closes #<issueNum> in description above)?
• [x] Have you ensured that you have met the expected acceptance criteria?
• [x] Have you created sufficient tests?
• [x] Have you updated all affected documentation?
• [x] Have you updated CHANGELOG.md (or extensions/CHANGELOG.md), if applicable