support `packageurl-js` >= 2.0.0

currently supporting `packageurl-js >=0.0.6 <0.0.8 || ^1`

goal: have support for `^2` added, while still maintaining support for the other versions that were supported already.

---

see release notes: <https://github.com/npm/normalize-package-data/releases>
see changes: <https://github.com/package-url/packageurl-js/compare/v1.2.1...v2.0.0>