Fix false positives for literal Go PURLs with subpaths

[immanuwell]

fixes the literal pkg:golang/...#... scan path from #2838.

right now grype builds pkg:golang/github.com/hashicorp/vault@v0.9.0#api/auth/kubernetes as github.com/hashicorp/vault, so it can match the wrong module. thats the bug.

this keeps the Go subpath when grype builds a package from a literal PURL. tiny change, no funny business.

repro:

1. run grype 'pkg:golang/github.com/hashicorp/vault@v0.9.0#api/auth/kubernetes'
2. before this patch, the package name becomes github.com/hashicorp/vault
3. with this patch, it becomes github.com/hashicorp/vault/api/auth/kubernetes

checks:

• go test ./grype/pkg -run Test_PurlProvider
• go test ./... in this env still trips in test/integration because .tool/skopeo is missing

related:

• False positive scanning purl pkg:golang/github.com/hashicorp/vault@v0.9.0#api/auth/kubernetes #2838
• fix: golang PURL should include full module syft#4395