[abhinavgautam01]

Closes #17

Summary

Adds ancestry to the shared package model so callers can record a known fork parent using the standard CycloneDX pedigree.ancestors field.

• New Ancestor type (Type, Name, Version, PURL) and a Package.Ancestors field.
• CycloneDX JSON and XML preserve ancestors through Parse and Encode, including unversioned and multiple ancestors.
• Ancestors are emitted without a bom-ref, so they cannot collide with installed components or be targeted by dependency entries.
• Ancestors never become Packages entries or DEPENDS_ON relationships.
• Documents without pedigree produce the same output as before. SPDX output does not include ancestors.

An unversioned repository ancestor encodes as:

"pedigree": {
  "ancestors": [
    {"type": "library", "name": "d3/d3", "purl": "pkg:github/d3/d3"}
  ]
}

Scope

This covers ancestors only. Descendants, variants, commits, patches and notes can be considered separately.

Tests

• Parsing JSON and XML documents whose pedigree component also has nested components and a dependency graph, checking that ancestors stay out of Packages and Relationships.
• Round trips across JSON to JSON, JSON to XML, XML to JSON and XML to XML.
• The exact JSON shape for an unversioned ancestor, with no version or bom-ref.
• XML element order: pedigree after purl and before properties, as the XSD requires.
• No pedigree output when a package has no ancestors.
• SPDX encoding ignores ancestors.

Verification

• gofmt, go vet, go mod tidy -diff
• go test -race ./...
• golangci-lint run ./...
• Encoded JSON and XML containing ancestors validate against the CycloneDX 1.5 JSON schema and XSD.
• git-pkgs builds and its SBOM tests pass against this branch.