fix: don't record purl for non conda-forge channels

[nichmor]

While trying to reproduce #1230 , I've observed that we record purl for packages even that are not conda-forge but from pytorch.

so by having this example:

[dependencies]
captum = {version="*", channel="pytorch"}
boltons = {version = "*"}

[pypi-dependencies]
captum = { version = "*"}

we need to have purl only for boltons, and empty purls for captum with a warning that pypi will overwrite it.

[tdejager]

So I guess the CI error is that because you now check if it is a conda-forge URL by checking its channel, it's actually dummy-channnel so you do not ament the purl.

So with this change you would not expect the package to have a purl :)