What happened:
The package name of the components on the purl are not percent encoded.

What you expected to happen:
According to the purl spec: https://github.com/package-url/purl-spec

The name is prefixed by a '/' separator when the namespace is not empty
This '/' is not part of the name
A name must be a percent-encoded string

How to reproduce it (as minimally and precisely as possible):

This can be check on a container image with g++ installed:

    <component type="library">
      <name>g++</name>
      <version>4:8.3.0-1</version>
      <purl>pkg:deb/debian/g++@4:8.3.0-1?arch=amd64</purl>
    </component>

Environment:

• Output of syft version:

Application:   syft
Version:       0.14.0
BuildDate:     2021-03-20T16:47:03Z
GitCommit:     26a4dd36a8932c7867fcdd6296f50643be30f8a6
GitTreeState:  clean
Platform:      linux/amd64
GoVersion:     go1.14.15
Compiler:      gc