Add Maven support for purl2url

[fafanoulele]

Add Maven support e.g.:

> purl2url.get_repo_url("pkg:maven/org.apache.commons/[email protected]")
"https://repo1.maven.org/maven2/org/apache/commons/commons-io/1.3.2"

> purl2url.get_download_url("pkg:maven/org.apache.commons/[email protected]")
"https://repo1.maven.org/maven2/org/apache/commons/commons-io/1.3.2/commons-io-1.3.2.jar"

[pombredanne]

@fafanoulele Thanks. The thing may be a bit more complex for JARs because of the many "artefacts" available for a given version....

[pombredanne]

See also #179 (comment)

[pombredanne]

Thank you. Here is some feedback for your consideration.

[pombredanne]

Could you handle the case with a repository_url qualifier that would override the default?

[fafanoulele]

Added support of repository_url cf. 2bc0cb9

[pombredanne]

You may also want to check this by @robertguetzkow aboutcode-org/dejacode#256 (comment)

I would also suggest using resolved URLs as the basis when they are already included in the SBOM and identifiable, instead of relying on purl2url which might not work for every package manager.

[fafanoulele]

@fafanoulele Thanks. The thing may be a bit more complex for JARs because of the many "artefacts" available for a given version....

I've added support for type and classifier as qualifiers e.g.:

> purl2url.get_download_url("pkg:maven/org.apache.commons/[email protected]?type=pom")
"https://repo1.maven.org/maven2/org/apache/commons/commons-io/1.3.2/commons-io-1.3.2.pom"

> purl2url.get_download_url("pkg:maven/org.apache.commons/[email protected]?classifier=arbitrary")
"https://repo1.maven.org/maven2/org/apache/commons/commons-io/1.3.2/commons-io-1.3.2-arbitrary.jar"