Today we use CPEs in grype during the matching process, however, this is really a SBOM field being ephemerally created and thrown away --this could be useful in other aspects SBOM-wise.

This PR does the following:

• Adds CPEs and PURL to the pkg.Package struct.
• Does post-processing of packages after the catalogers but before being added to the catalog.
• The above point makes the syft.Catalog step dependent on distro, so distro identification has been moved under this call (and removed as an independent action from lib.go)
• When distro.Identify() cannot identify a distro it now returns nil, being consistent with other properties that have the same behavior.
• Unrelated: oraclelinux distro testing was missed previously, so was added here

Notes:

• this PR opens up future work to include CPEs into presenters (Add the Common Platform Enumeration (CPE) for the CycloneDX output #268), but in this PR has only been exposed in the JSON presenter.
• this PR decided to do a "minimal" approach and allow a central spot (within syft.cataloger) to be responsible for accumulating purls and CPEs and attaching them to a package object, however, there is probably a better way to do this in the future. One outcome of this was to start considering individual catalogers to be only responsible for discovering and raising up "raw" information from the entity being cataloged, and interpretations of this data is considered "out of scope" for the catalogers and should be attached to the package downstream of the individual catalogers.

Closes #269