fix: spdx sbom cpe bug

[AryanBakliwal]

fixes: #4700

Changed the order of decoding at parse.py#L382

Output

╭─────────────╮
│ CPE SUMMARY │
╰─────────────╯
┏━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┓
┃        ┃          ┃         ┃ Latest       ┃              ┃              ┃              ┃              ┃              ┃              ┃
┃        ┃          ┃         ┃ Upstream     ┃              ┃              ┃              ┃              ┃              ┃              ┃
┃        ┃          ┃         ┃ Stable       ┃ CRITICAL     ┃ HIGH CVEs    ┃ MEDIUM CVEs  ┃ LOW CVEs     ┃ UNKNOWN CVEs ┃ TOTAL CVEs   ┃
┃ Vendor ┃ Product  ┃ Version ┃ Version      ┃ CVEs Count   ┃ Count        ┃ Count        ┃ Count        ┃ Count        ┃ Count        ┃
┡━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━┩
│ arm    │ mbed_tls │ 3.6.0   │ 3.6.2        │ 1            │ 0            │ 1            │ 0            │ 0            │ 2            │
└────────┴──────────┴─────────┴──────────────┴──────────────┴──────────────┴──────────────┴──────────────┴──────────────┴──────────────┘
╭─────────────────╮
│  NewFound CVEs  │
╰─────────────────╯
┏━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━━━━━━━┳━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━┓
┃ Vendor ┃ Product  ┃ Version ┃ CVE Number     ┃ Source ┃ Severity ┃ Score (CVSS Version) ┃
┡━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━━━━━━━━╇━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━┩
│ arm    │ mbed_tls │ 3.6.0   │ CVE-2024-45157 │ NVD    │ MEDIUM   │ 5.1 (v3)             │
│ arm    │ mbed_tls │ 3.6.0   │ CVE-2024-45159 │ NVD    │ CRITICAL │ 9.8 (v3)             │
└────────┴──────────┴─────────┴────────────────┴────────┴──────────┴──────────────────────┘
┏━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━┳━━━━━━┳━━━━━━━━━━┓
┃ Vendor ┃ Product  ┃ Version ┃ Root ┃ Filename ┃
┡━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━╇━━━━━━╇━━━━━━━━━━┩
│ arm    │ mbed_tls │ 3.6.0   │      │          │
└────────┴──────────┴─────────┴──────┴──────────┘
╭───────────────────────────────────────────────╮
│  Products with No Identified Vulnerabilities  │
╰───────────────────────────────────────────────╯
┏━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━┓
┃ Vendor ┃ Product ┃ Version ┃
┡━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━┩
└────────┴─────────┴─────────┘

[AryanBakliwal]

@terriko @anthonyharrison PTAL and let me know what you think

[terriko]

This would resolve that bug, but I think @anthonyharrison is correct that it may introduce some not-so-great side effects.

Right now, I'd like us to change things so we return ALL references rather than having a preference order at all. (I know, @anthonyharrison is asserting that we could just prefer purl, but obviously that's what we were doing and it wasn't working as people expected either.)

So you'd need to get rid of the elifs and set this up to return a potential list of tuples, and possibly change anywhere that parse_ext_ref is called to handle an list instead of a single tuple.