"project createBom" doesn't handle multiple purls

[gernot-h]

After fixing #26 in main, we still lack correct handling of multiple purls. CaPyCli silently takes the JSON-encoded string containing the array, so we get such a BOM:

    { 
      "type": "library",
      "bom-ref": "[\"pkg:deb/debian/libacl1@2.2.52-3\",\"pkg:deb/debian/acl@2.2.52-3?arch=source\"]",
      "name": "acl",
      "version": "2.2.52-3.debian",
      "purl": "[\"pkg:deb/debian/libacl1@2.2.52-3\",\"pkg:deb/debian/acl@2.2.52-3?arch=source\"]",

I also think there's no perfect solution as CycloneDX allows only one purl per component, but we should at least warn the user and probably make it easy for him to select the right purl, e.g. by adding them separated by space?

[gernot-h]

Added a possible implementation in #37.