Incorrect purls reported for bundled code in package scan

[chinyeungli]

Package scan for next-14.2.26 is correctly reported as pkg:npm/next@14.2.26 . However, all the sub-packages (bundled code) are also reported as pkg:npm/next@14.2.26 which may not be correct.

input: https://www.npmjs.com/package/next/v/14.2.26?activeTab=code

For instance,

    {
      "path": "code/next-14.2.26.tgz-extract/package/dist/compiled/@edge-runtime/primitives/fetch.js.text.js",
      "type": "file",
      "package_data": [],
      "for_packages": [
        "pkg:npm/next@14.2.26?uuid=44b2abd3-413c-432f-88e5-dc1cd843855b"
      ],
      "scan_errors": []
    },

The for_packages should be: pkg:npm/@edge-runtime/primitives

    {
      "path": "code/next-14.2.26.tgz-extract/package/dist/compiled/@ampproject/toolbox-optimizer/index.js",
      "type": "file",
      "package_data": [],
      "for_packages": [
        "pkg:npm/next@14.2.26?uuid=44b2abd3-413c-432f-88e5-dc1cd843855b"
      ],
      "scan_errors": []
    },

The for_packages should be: pkg:npm/@ampproject/toolbox-optimizer