Report otp purls for extra_applications.

See https://security.erlef.org/specs/otp_purl_type