fix: bom_ref is not set always hence adding purl also for the checks

[sachinshaji]

As we skip source url checks for debian components, the if condition is updated to add checks for bom_ref and purl

[gernot-h]

@16Martin, this might be interesting for you, I think this part of the code has already caused some problems in your pipelines...