`purl` section missing guidance for other types

[hdonnay]

The VEX data contains the following purl types:

• generic
• koji
• maven
• npm
• oci
• rpm

Only rpm and oci are discussed in the guidelines; how should the others be used?
Also, the koji type is not standardized, where is it documented?

[mprpic]

In general, we don't aim to describe every single purl type that exists in our guidelines, only those that have some ambiguities in their definitions (like rpm) or when there is a particular way that Red Hat uses them. Of the ones you pasted (minus rpm and oci):

• generic is just what the purl spec says, an arbitrary link to some component that doesn't necessarily belong to a specific ecosystem. Though, looking at the existing data, it seems that some data migration was done to convert some older-type middleware (java-based) component names to use the generic type without any other information. Internally, OSIDB-3411 is filed to do a proper migration of old component names into correct purls; I added a comment in there to address this.
• The single npm purl that is used in CVE-2016-7066 is similarly a mistake and a miscategorized package type. Made a note in OSIDB-3411 about this as well.
• The koji type is a way to refer to Brew builds internally to be backwards compatible with how we used to refer to container images that were imported into Brew. Ideally this will go away soon with the switch to Konflux and the use of normal oci image identifiers. I filed a separate issue for this: PSDEVOPS-4475.
• maven is documented here: https://redhatproductsecurity.github.io/security-data-guidelines/purl/#identifying-maven-packages