Add info on purls (https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#oci) as one means to identify externally persisted artifacts and evidence.