Normalize package.json, requirements.txt, or go.mod direct dependencies into deterministic package records and purls.