All our 3rd party sources have (or should have) an accompanying qt_attribution.json file.

To more easily track our 3rd party supply chain, we should add relevant CPE and PURL values to the qt_attribution.json files in all our repositories.

What CPE and PURL means can be found at https://wiki.qt.io/SBOM#CPE_and_PURL_values_in_qt_attribution.json_files

qtbase is handled via https://codereview.qt-project.org/c/qt/qtbase/+/578553

We need to the same for the following repos:

• qt3d attribution reference
• qt5compat attribution reference
• qtapplicationmanager attribution reference
• qtconnectivity attribution reference
• qtdeclarative attribution reference
• qtgrpc attribution reference
• qtimageformats attribution reference
• qtinterfaceframework attribution reference
• qtmultimedia attribution reference
• qtopcua attribution reference
• qtpositioning attribution reference
• qtquick3d attribution reference
• qtsensors attribution reference
• qtshadertools attribution reference
• qtsvg attribution reference
• qttools attribution reference
• qtvehicleservices attribution reference
• qtvirtualkeyboard attribution reference
• qtwayland attribution reference