Fix mix.lock git/path deps mislabeled as hex.pm packages with bogus PURLs

[Synvoya]

Description

mix.lock git and path dependencies were mislabeled as hex.pm packages with a garbage version and a bogus pkg:hex/... PURL — a source of false hex.pm vulnerability matches.

parseMixLock read the version from a fixed token position (tokens[4]) that only holds for hex entries. For a git entry like

"enacl": {:git, "https://github.com/aeternity/enacl.git", "2f50ba6...", [ref: "2f50ba6"]},

tokens[4] is a URL fragment, and the type/PURL were hardcoded to hex, so syft emitted version //github.com/aeternity/enacl.git with PURL pkg:hex/enacl@%2F%2Fgithub.com....

Fix

Branch on the source atom (hex / git / path):

• hex — unchanged (output is byte-identical).
• git — version = the commit SHA; no pkg:hex/ PURL.
• path — empty version; no pkg:hex/ PURL.

The pkg:hex/ PURL is now emitted only for hex-sourced deps, which removes the false hex.pm matches. I kept the metadata type as the existing Elixir mix-lock entry to avoid changing the versioned JSON schema — happy to surface git/path deps as UnknownPackage instead if you'd prefer.

Test

Added git and path entries to testdata/mix.lock with expected name/version/PURL asserted in parse_mix_lock_test.go; all existing hex expectations are unchanged.