Enrich Nixpkgs with correct PURLs for accurate SBOMs

NixOS is uniquely positioned to generate accurate, reproducible Software Bills of Materials (SBOMs) from its declarative build graph, yet current SBOM generators must infer Package URLs (PURLs) from package names and heuristics leading to inaccuracies that matter under regulations like the EU Cyber Resilience Act. This project fixes the problem at the source: 1. by enriching nixpkgs package metadata so that correct PURLs are embedded directly into derivations, eliminating guesswork downstream(SBOM generators like bombon, sbomnix etc). The core blocker is that passing meta attributes through .drv files currently risks triggering massive content-addressed reverse dependency rebuilds. This project will help land the key upstream PRs (notably Robert Hensing's PR #14686 / nixpkgs #466932) that allow selected metadata to flow into .drv without affecting store path computation. With that foundation in place, a systematic series of nixpkgs PRs will enrich packages that currently carry inaccurate or missing PURL metadata, while coordinating with SBOM tool authors (e.g. bombon, Syft, sbomnix) to reduce heuristics and consume the authoritative data. Deliverables: 1. community coordination to get the PRs blocking enrichment merged 2. a batch of nixpkgs enrichment PRs covering packages with known PURL inaccuracies 3. upstream patches or issues filed against SBOM generators to adopt the enriched metadata