feat: map artifacts to commits via repo tags

[benmss]

This feature allows artifacts with a specified version to be mapped to the repository commit they were created from.
The mapping is achieved through use of repository tags, where these tags match the specified version sufficiently.
Tag to version comparisons are performed using regular expression.

Tags are expected to be of the format (with allowances for extra characters):
[<artifact_name>-]<version>

artifact_name is an optional prefix that matches the name of the related artifact, e.g. "commons-io".

<version> is a string of some number of alphanumeric characters that can be (multi-) separated by any number of non-numeric characters.

Examples of accepted tag versions:

• v1.2.3
• 1_2_3
• 1.2.3-DEV
• 1.2.3.RELEASE
• r1rv23
• 1.2.3.v123123

Further changes to this PR are in progress:

• Support tags whose suffix does not match their related version
• Do not fallback to latest commit if the commit finder fails
• Use default branch for commits with no associated branch (for now)
• Use purls with versions instead of commits in integration tests
• Allow for purls that represent repositories not just artefacts
• Extend test file to include purls and comments
• Use Hypothesis to test commit finder input

[behnazh-w]

Looks like for pkg:maven/com.google.guava/[email protected]?type=jar the commit finder maps the artifact to (adde55ee1f9bc7fb053183b5465f413547c198fe) which is the latest commit on master.

Can you please create tasks for the following items in the PR description?

1. We should cover cases where artifact versions have suffixes that do not match tags.
2. If a tag is not found, as we had discussed before, we shouldn't fall back to the latest commit. Instead, the repository should be None to fit it the current data model.
3. Since we have a commit mapping feature, we shouldn't need to pin tests in the integration tests to a commit anymore. Just passing the purl should be enough. So, we can probably remove at least some of the -c config.yaml runs in the integration tests with purl

Here is one dependency from apache_maven_root_sbom.json which we use in our integration tests that is also mapped to the latest commit: pkg:maven/org.junit.jupiter/[email protected]?type=jar

[nathanwn]

I think it's an LGTM for now. Thanks for your work.