fix: add deepcopy for purl manipulation in manifest, per Jonathan

mentioned in commit eac98f29

mentioned in commit 5d476590

mentioned in merge request hoppr/plugins/hoppr-openssf-scorecard-plugin!50 (closed)

mentioned in merge request hoppr-cop!397 (merged)

mentioned in merge request hoppr/plugins/hoppr-nexus-bundler!234 (merged)

mentioned in merge request hoppr/plugins/starter-plugin!10 (merged)