feat: populate package supplier in CycloneDX and SPDX

[MackJM]

Description

Populates the package supplier and homepage across SBOM output, derived
from existing package metadata.

• Supplier — from rpm vendor/packager, deb/apk maintainer, language-ecosystem
  authors, elf vendor, etc. Emitted as a CycloneDX OrganizationalEntity
  (name + contact email + url) and as the SPDX PackageSupplier / PackageOriginator.
• Homepage — emitted as a CycloneDX website external reference and the SPDX
  PackageHomePage.

This implements the supplier element of the NTIA minimum SBOM requirements
(#1961), which syft previously left unasserted for most packages.

Verified output against cyclonedx-cli (JSON + XML) and pyspdxtools across rpm, apk, deb, npm, pypi, and maven.

RPM supplier/homepage relies on two new go-rpmdb header tags (RPMTAG_PACKAGER, RPMTAG_URL).

Draft — blocked. Depends-On: https://github.com/anchore/go-rpmdb/pull/18
The go.mod currently has a temporary replace pointing at a personal go-rpmdb
fork so CI can build. Before this leaves draft, the replace will be removed and
require github.com/anchore/go-rpmdb bumped to the released version containing the
new tags.

Type of change

• New feature (non-breaking change which adds functionality)

Checklist

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

Issue references

Fixes #1961
Relates to #632 (NTIA minimum elements — populates the Supplier Name element)
Depends-On: anchore/go-rpmdb#18