Description

This PR adds support to the graalvm-native-image-cataloger to associate location data with the packages extracted from native images. Packages extracted are now associated with file.Location metadata, which refers to the native image.

This enables users to easily trace packages back to the native image executable, simplifying vulnerability identification.

Example

Consider this scenario: syft scans a Docker container containing a native image named app that has a dependency on org.json. The org.json artifact currently looks like this in the syft-json format:

{
    "id": "pkg:maven/org.json/json@20250517",
    "name": "json",
    "version": "20250517",
    "type": "java-archive",
    "foundBy": "graalvm-native-image-cataloger",
    "locations": [], <-- locations is empty
    ...
}

This PR ensures the locations data is added:

{
    "id": "pkg:maven/org.json/json@20250517",
    "name": "json",
    "version": "20250517",
    "type": "java-archive",
    "foundBy": "graalvm-native-image-cataloger",
    "locations": [
        {
            "path": "/app",
            "layerID": "sha256:f1cf2e7664a1a9e45052d20a7061d9e46eb93091e092b4aa4166197cee5a3604",
            "accessPath": "/app"
        }
    ],
    ...
}

Type of change

• New feature (non-breaking change which adds functionality)

Checklist:

• I have added unit tests that cover changed behavior
  No new unit tests were added since the logic is trivial and there is currently no straightforward way to test it. Issue #3718 would enable end-to-end tests using native images with embedded SBOMs.
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections