feat(sbom): canonicalize component identity

[stacknil]

Summary

• add an immutable CanonicalComponentIdentity for ecosystem, package name, version, purl, and component key
• parse purls with packageurl-python and apply explicit PyPI/PEP 503 normalization
• distinguish duplicate_component from conflicting_metadata in both Python errors and CLI output
• drive diff equality and version classification from canonical identity
• cover CycloneDX-to-SPDX alignment, lexical variants, purl-only version changes, and conflict paths

Validation

• python -m pytest (213 passed)
• python -m ruff check on all changed Python files
• python scripts/regenerate-example-artifacts.py --check
• python scripts/validate-reviewer-routes.py
• python -m pip check
• wheel/sdist build plus wheel metadata inspection
• git diff --check

Boundaries

• no report schema expansion
• no repository split
• only PyPI name normalization is project-defined; other ecosystem names preserve case until test-backed rules exist