Package vs. component: we need to support this cleanly

[pombredanne]

This is a design and discussion item carried from #345 (comment):

we have eventually package- and component-level data.
The package would be identified by the Package URL or purl fields (type, namespace, name, version, qualifiers, subpath); and the component by its name/version.
We would need to refine how we handle cases where we have data from both

[pombredanne]

The package part should be the main focus of V4. Support for component could go in v4.1

[mjherzog]

I think that we have evolved to a point where each item in an inventory is a Package with a purl or not (Component). We do not need to support overlap here.