fix: preserve colon package names in catalog label assignments

[omribz156]

Summary:

• Replace package:type:version string keys in catalog label version-assignment state/update handling with a structured key.
• Preserve package names that contain : (for example Maven coordinates such as mysql:mysql-connector-java) when adding, changing, or removing version assignments.
• Add focused unit coverage for colon-containing package names and a changelog entry.

Verification:

• go test ./pkg/xray/resource -run '^TestNewVersionAssignmentKeyKeepsColonPackageNameIntact$' -count=1
• go test ./pkg/xray/resource -run '^$' -count=1
• go test ./pkg/... -run '^$' -count=1
• git diff --check

Not run:

• Full acceptance tests, because they require a configured JFrog/Xray instance and XRAY_URL or JFROG_URL.

This was implemented with Codex assistance, with the patch kept focused and manually reviewed.

Closes #415