SPDX JSON created should contain a lowercase PURL key

[sebsnyk]

While the SPDX spec is not mandating lowercase field names (or is explicit about case sensitivity), generally all fields in the spec are written in lowercase.

This is also the case for the purl field, which is currently blocking SPDX files generated by sbom-tool to be ingested by downstream tooling.

Let's ensure the field names generated by this tool are all lowercased to ensure maximum compatibility.

(for reference, cdxgen does this correctly).

cc @mcombuechen