enhancement(assembly): split Microsoft Update (.mum) servicing dirs into one package per component

[mstykow]

Context

DatasourceId::MicrosoftUpdateManifestMum is routed through the WindowsUpdate special directory merger (src/assembly/windows_update_merge.rs), which collapses a servicing/Packages directory holding hundreds of distinct .mum components into a single package. Unlike the Maven/BitBake/NuGet collapses fixed via SiblingMergePerIdentity, the .mum parser sets a name+package_type but no purl, so the generic purl-keyed per-identity split does not apply.

Proposal

Make windows_update_merge key on the component name (or emit a purl in the parser) so each distinct .mum component surfaces as its own package instead of collapsing into one.

Acceptance

• A directory with multiple distinct .mum components yields one package per component.
• Contract test in microsoft_update_manifest scan tests.