feat: added PURL generation to PhpParser

[joydeep049]

Related #3771.

"Composer" based packages do contain vendor information for their components so I guess we do not have to do extra work later for getting vendor info.

cc @terriko @anthonyharrison

[joydeep049]

With this , I guess most of the PURL generation parts are done.
We can now begin working on adding unit tests to the generate_purl method as filed in #3961.

Will take me a bit of time as I have a number of assignment submissions and presentations this week, but I'll start working on it next week.

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 36.36364% with 7 lines in your changes are missing coverage. Please review.

Project coverage is 80.39%. Comparing base (d6cbe40) to head (d439a6a).
Report is 148 commits behind head on main.

Files	Patch %	Lines
cve_bin_tool/parsers/php.py	36.36%	7 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4016      +/-   ##
==========================================
+ Coverage   75.41%   80.39%   +4.97%     
==========================================
  Files         808      820      +12     
  Lines       11983    12583     +600     
  Branches     1598     1951     +353     
==========================================
+ Hits         9037    10116    +1079     
+ Misses       2593     2050     -543     
- Partials      353      417      +64     

Flag	Coverage Δ
longtests	75.49% <36.36%> (+0.07%)	⬆️
win-longtests	78.60% <36.36%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[joydeep049]

Also @terriko , had some ideas as to how a new abstraction layer could be added for the purl2cpe database as @anthonyharrison suggested after reviewing my proposal. Whenever you're free we can discuss about that.

Cheers!

[terriko]

Yay for having vendor info!

And feel free to kick off discussions any time in the issues, I'm just trying to focus on release stuff but everyone else involved in the project might like to talk about it!

I'm marking this as approved now, not sure if I'm going to merge it before or after the release.

[joydeep049]

Yay for having vendor info!

And feel free to kick off discussions any time in the issues, I'm just trying to focus on release stuff but everyone else involved in the project might like to talk about it!

I'm marking this as approved now, not sure if I'm going to merge it before or after the release.

I think I'm gonna spend bit of time this month trying to figure out data sources to get vendor information for package types lile PyPi and cpan. (So that we can spend more time implementing and less time researching during the GSoC project.)

I did also have some further ideas on the abstraction layer for the purl2cpe database as well. So that we can maybe swap that database for a new one possibly in the future as @anthonyharrison suggested.

[terriko]

Release is done, time to get this merged. thank you again!