[Bug]: SBOM upstream entry uses the purl.version value when purl.upstream is not set #1376

Related: #1370, #1371

Why this is a bug

The purl.version setting changes the version of the wheel entry (SPDXRef-wheel) in the SBOM.
If purl.upstream is not set, purl.version also changes the version of the upstream entry (SPDXRef-upstream).
PR #1371 did not change the upstream entry. The problem continues after PR #1371.

• The upstream entry identifies the source that fromager used. The upstream project released 0.5.5.
  The upstream project did not release 0.5.5+local.1.
• The GENERATED_FROM relationship points from the wheel to the upstream entry.
  As a result, the relationship points to a version that does not exist upstream.
• Tools that use this relationship cannot find the upstream release.
• If sbom.repository_url is not set, the two entries have the same purl.
  Then the SBOM does not show a difference between the wheel and its source.
• The purl.upstream setting prevents this problem. But fromager does not tell users that this setting is necessary.
• The tests that PR sbom: Derive document name and namespace from downstream purl #1371 added set purl.upstream. Because of this, the tests do not find this problem.

Steps to reproduce

1. Install fromager from the main branch, at commit 45241aad or a later commit.
   Fromager 0.101.0 also shows the problem.

2. Make the file overrides/settings.yaml with this content:

   sbom:
     supplier: "Organization: ExampleCo"
     namespace: "https://sbom.example"

3. Make the file overrides/settings/sqlparse.yaml with this content:

   purl:
     version: "0.5.5+local.1"

4. Do not set purl.upstream.

5. Build the wheel:

   fromager bootstrap sqlparse==0.5.5

6. Show the SBOM values of the upstream entry:

   WHL=$(ls wheels-repo/downloads/sqlparse-*.whl)
   unzip -p "$WHL" '*.dist-info/sboms/fromager.spdx.json' \
     | jq '.packages[1] | .versionInfo, .externalRefs[0].referenceLocator'

7. Compare the values with the correct values.

   Actual values:

   "0.5.5+local.1"
   "pkg:pypi/sqlparse@0.5.5%2Blocal.1"
   

   Correct values:

   "0.5.5"
   "pkg:pypi/sqlparse@0.5.5"
   

🤖 Generated with Claude Code