package-metadata: add CPE information to JSON package manifests