Figure out how to handle CycloneDX components that don't come with PURLs.

[lumjjb]

While working with some CDX SBOMs, we were faced with some entries where PURLs were not available (ref: https://github.com/guacsec/guac/issues/236).

Additional discussion is needed to ensure that we are able to handle these cases in a way that is valid for our use cases.