Support OSSelot as a curation provider

[sschuberth]

OSSelot is OSADL's "branding" of @OliverFendt's https://github.com/Open-Source-Compliance/package-analysis. With OSADL's backing that repository probably gets more traction, so we should consider adding is as a curation provider despite a few issues:

• There is no API; curations are stored in tag-value (!) SPDX files. Also see Please provide SPDX files in JSON / YAML format Open-Source-Compliance/package-analysis#20.
• The repository focuses on curations for embedded (Linux) development. This means there usually is no package manager involved. As a result, many of the PURLs simply use generic as the type (see here, and click on "Show package URLs").
• The use of generic means that download_url / vcs_url qualifiers are required to concretely identify packages. However, currently ORT does not take URLs into account when looking up curations, as only ORT package ids are used (this is actually being addressed as part of Change the curation provider API to take packages instead of ids #6387).

[sschuberth]

There is no API

By now there is, see https://wiki.osselot.org/index.php/REST. However, that "API" only gets us SPDX files in different formats.