feat: Github fallback for empty PURL for license exclusion

[jscaltreto]

The action uses the change's package_url (as returned from the dependency graph API) to match against the exclusions passed via allow-dependencies-licenses. However, some changes do not include package_url, but they can still result in the action failing a license check as the check itself doesn't rely on package_url. Currently there's no mechanism in place to exclude a dependency from the license check if the package_url is empty.

This adds a fallback mechanism that parses source_repository_url to attempt to match based on the repository name. So allow-dependencies-licenses could include, for example, pkg:github/owner/repo and that would match a change with source_repository_url: "https://github.com/owner/repo".

This doesn't cover all cases; if source_repository_url is empty or doesn't point to a github-hosted repository then it will still fail to match.