Add an utility method on the advisory framework to fetch product identifiers

[mpermar]

Vulnerability scanners will tipically grab a VEX assessment, look at each vulnerability status and then get the array of product ids. But those product ids are usually meaningless to scanners. They do need the product identifiers. And those identifiers might be deep in the CSAF product tree at different levels. So there is definitely always some tree navigation that needs to be done for being able to grab the purls, cpes, etc.

It would be nice if this library offered some way to fetch a list of purls for a given list of product identifiers. I have a naive PoC implementation here but it is only for PURLs. Ideally this should be abstract enough to support other identification mechanisms.