coin: add CPEs to the generated vcpkg attribution files

vcpkg's SPDX documents carry PURLs but no CPEs, and a CPE is the only
identifier Qt's Dependency-Track instance can scan, so the generated
attribution files were of no use for vulnerability scanning.

Compose the CPE from the port version and a table mapping port names to
a CPE vendor and product, kept in vcpkg_port_cpes.json next to the
generator because CPE names track the NVD dictionary rather than
anything in the build. A port absent from the table gets no CPE at all:
the obvious guesses icu:icu and fontconfig:fontconfig match nothing in
NVD, and a CPE that matches nothing produces a clean scan that means
nothing.

The table covers the seven ports Qt links on OHOS. Four of the entries
are copied from the matching qt_attribution.json under
qtbase/src/3rdparty, the other three were looked up in the NVD CPE
dictionary.

The version is baked into the string instead of using Qt's $<VERSION>
placeholder, which is substituted with the version find_package
reported. For libjpeg-turbo that is libjpeg's API version 62, so a
templated CPE would come out as
cpe:2.3:a:libjpeg-turbo:libjpeg-turbo:62:*:*:*:*:*:*:* and match
nothing.

Task-number: QTBUG-150865
Change-Id: I4c975862392d4e355b90ea7b859791a6aecf1a3e
Reviewed-by: Alexandru Croitor <alexandru.croitor@qt.io>