Improve .NET package CPE generation

[wagoodman]

This is a follow up to #3563 to improve the CPE generation for .NET packages. Take for instance OWASP.AntiSamy where a good CPE example is cpe:2.3:a:spassarop:owasp_antisamy_.net:*:*:*:*:*:*:*:*.

Today we're generating for this package:

[
  {
    "cpe": "cpe:2.3:a:OWASP.AntiSamy:OWASP.AntiSamy:1.2.1:*:*:*:*:*:*:*",
    "source": "syft-generated"
  }
]

Taking a look at the CPE dictionary it seems that most (all?) .NET applications normalize . to _ and some get a .net suffix. With these changes + adding in other data sources from the metadata we can generate this:

[
  {
    "cpe": "cpe:2.3:a:owasp_antisamy:owasp_antisamy_.net:1.2.1:*:*:*:*:*:*:*",
    "source": "syft-generated"
  },
  {
    "cpe": "cpe:2.3:a:owasp_antisamy:owasp_antisamy:1.2.1:*:*:*:*:*:*:*",
    "source": "syft-generated"
  },
  {
    "cpe": "cpe:2.3:a:owasp_antisamy:antisamy_.net:1.2.1:*:*:*:*:*:*:*",
    "source": "syft-generated"
  },
  {
    "cpe": "cpe:2.3:a:spassaro:owasp_antisamy_.net:1.2.1:*:*:*:*:*:*:*",
    "source": "syft-generated"
  },
  {
    "cpe": "cpe:2.3:a:owasp_antisamy:antisamy:1.2.1:*:*:*:*:*:*:*",
    "source": "syft-generated"
  },
  {
    "cpe": "cpe:2.3:a:spassaro:owasp_antisamy:1.2.1:*:*:*:*:*:*:*",
    "source": "syft-generated"
  },
  {
    "cpe": "cpe:2.3:a:spassaro:antisamy_.net:1.2.1:*:*:*:*:*:*:*",
    "source": "syft-generated"
  },
  {
    "cpe": "cpe:2.3:a:spassaro:antisamy:1.2.1:*:*:*:*:*:*:*",
    "source": "syft-generated"
  }
]

This is about as close as we can get to the candidate (note that the vendor on the CVE has a suffix p, but this is not present in the underlying data).

I also found a few tests out of place and with extra vars not used anywhere.

Type of change

• New feature (non-breaking change which adds functionality)

Checklist:

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections