PURL qualifier-based search

[gernot-h]

Contains following changes/features:

• always search through all releases and include all best matches, don't abort on first good match -> implements new option for "bom map" to allow multiple good matches #150
• return multiple releases with matching PURL -> implements PURL fallback mapping strategy #139
• consider PURL qualifiers during mapping if there's a full qualifier match -> implements PURL fallback mapping strategy #139

Fixes #139
Fixes #150

[gernot-h]

This is mostly ready, but unconditionally changing the mapping behaviour. I agreed with @tngraf to keep current mapping behaviour as default and add commandline switches for the new mapping algorithms.

Currently, we have the following switches changing behaviour of "bom map":

• -all – report all name matches if there are no version matches
• --mode – allows to only show found or notfound entries in output SBOM
• --dbx – ignore Debian version string suffices during mapping

-all and --dbx seem to be used not only in "bom map", but also for "bom createcomponents" and "bom show".

To not end up with numerous cmdline parameters in "bom map", I agreed with @tngraf to deprecate -all and --dbx for "bom map" and instead add a new parameter --matchmode with comma-separated options like all-versions (replacing -all), ignore-debian (replacing --dbx), full-search (new feature from this MR: return all best matches for releases and PURLs), qualifier-match (new feature from this MR: consider PURL qualifiers).

[gernot-h]

@t-graf, the PR is finally ready for review and probably merging. This basically contains three changes:

• replace --dbx and -all by --matchmode (first commit)
• matchmode "full-search" to check all releases and report all best matches (commits 2 + 3)
• matchmode "qualifier-match" match using PURL qualifiers (commit 4, the largest one)

I suggest to review the changes commit by commit, and if you want we can also split this into two PRs, just let me know!