CycloneDX group field not symmetrically handled by encoder/decoders

[wagoodman]

We have a few issues around the group field in CycloneDX:

• Fix decoding package groups from cyclonedx sboms #1345 (decoding)
• @jridgewell/gen-mapping incorrectly attributed GHSA-8rmg-jf7p-4p22 grype#1886
• Vulnerability reported on @group/name dependency when actual vulnerability exists on name dependency grype#1701

Ultimately what should happen is that:

• the encoders for CycloneDX should consider spitting the name into name and group based on the package ecosystem
• the decoders for CycloneDS should consider combining the group back into the name based on the package ecosystem

This would at least help with a few of the grype issues, though, there is more work in grype needed to consider if group should be removed or added when searching for vulnerabilities (which is different than specific SBOM considerations).

[willmurphyscode]

Should be discussed with #1202 and anchore/grype#1886 since these are all interconnected.

[willmurphyscode]

Found another issue that is part of the same cluster of issues: anchore/grype#2037