Correct or incorrect handling of NPM capitalization

[matt-phylum]

NPM package names are case sensitive, but the PURL spec says they must be lowercased (package-url/purl-spec#136). This library is adhering to the PURL spec instead of NPM for NPM types, and mangling some rare NPM package names in an unrecoverable way.

Go module paths are case sensitive, but the PURL spec says they must be lowercased, and this library is adhering to the Go rules (mostly) instead of the PURL spec. Should NPM also deviate from the PURL spec?

[jdalton]

@matt-phylum

Thanks for raising this!
Yep, older names were a bit yolo.
We can leverage npm's validate-npm-package-name package to validate this.

[jdalton]

@matt-phylum PR up for feedback at #80.