Fix `osv::scan-purl` to not require optional namespaces

[jcrossley3]

PURL namespaces are optional, as appropriate for the package type. Specifically, npm equates namespaces to scopes and doesn't require a namespace for a non-scoped package.