Refine the definition of Artifact IDs about spec

[afrittoli]

Using https://github.com/package-url/purl-spec is one option.
We could include purl or say that the artifact ID needs to have properties similar to those of a purl.
Specifically the artifact ID should not change when an artifact is published in different locations.

Build events should produce an artifact ID in this format.
Artifact packaged and published events should produce and artifact ID in this format.
Artifact published events should additionally include an artifact URL attribute.

[afrittoli]

There is value in enforcing the type for consumers to parse the artifact ID - not having one format harms interoperability.

• Set this as a required field
• Reach out to the purl community
• Update the SDK (follow up)

[afrittoli]

Security related aspects of artifact ID will be covered in #70