refactor: move PkgRef under PkgIdentifier

[knqyf263]

Description

PkgRef stores package identifiers, like BOM-Ref and PURL, in SBOM. Since #5439 added a new field Identifier for PURL, PkgRef should be moved under the new field. PkgRef can have both BOM-Ref and PURL, but PURL already has a dedicated field under Identifier. Therefore, this PR adds a new field for BOM-Ref.

PkgRef is for internal use, so we believe it won't break anything, but it is exported in JSON and people can rely on the field. We'd announce it just in case.

Related PRs

• feat(vuln): include pkg identifier on detected vulnerabilities #5439

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

LGTM