fix(sbom): Use UUID as BomRef for packages with empty purl

[DmitriyLewen]

Description

After #5190 we don't create purl for Golang dependencies with replace to local directory.
But we still create CycloneDX component, but BomRef and purl for these packages are incorrect.
See more in #5434

We should skip wrong purl and use UUID for BomRef for these components.

Related Issues

• Close bug(cyclonedx): wrong purl for local Go dependencies #5449

Related PRs

• fix(purl): skip local Go packages #5190

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

I thought about this case for a long time.
We don't create PURL for dependencies with local path as name:

trivy/pkg/purl/purl.go

Lines 368 to 371 in 26b4959

	// The PURL will be skipped when the package name is a local path, since it can't identify a software package.
	if strings.HasPrefix(pkgName, "./") || strings.HasPrefix(pkgName, "../") {
	return "", ""
	}

But perhaps we need to skip these dependencies when parsing Go files in go-dep-parser:
https://github.com/aquasecurity/go-dep-parser/blob/6f348921ea39b74251940077b07d337bb468f3c8/pkg/golang/binary/parse.go#L47-L66

@knqyf263 wdyt?

[DmitriyLewen]

As @knqyf263 correctly said - we need to save Go local packages using the UUID as the BomRef.

[knqyf263]

nit: Is there any reason to make it an independent if-statement rather than else if?

[DmitriyLewen]

I don't see point of using else if, because we return error when err != nil.
And independent if seems to me more readable.