syft should be aware of user-specified content files, which can override or add additional known packages to a catalog.