fix: improved Python binary detection

[kzantow]

Originally, when Python binary detection was added, it checked 3 sources:

• python* binaries directly
• libpython* shared libraries
• patchlevel.h source file

The reason for the latter 2 - especially the last one, is that some Python binaries do not actually contain version information but instead load a libpython* shared library, which contains this.

This has caused some confusion for users and did not necessarily prove to be the most accurate. This PR changes the behavior such that patchlevel.h is never looked for, as there is no guarantee this would be applicable to the particular python binary file found. Additionally, when inspecting Python binaries, the behavior is now:

1. look for version information in the file and use this if found
2. look for the corresponding libpython* shared library in the binary dynamic library list, and extract version information from that file

With this change, Syft does still look for libpython* files independently, and these may or may not show up as the primary location for a package.

The result is a few different cases:

• A Python binary is found, with version information and a libpython shared library is found. If the versions are the same, both locations will be merged to the same package. If the versions are different, there will be 2 distinct packages with the corresponding location information.

• A Python binary is found, without version information and a libpython shared library is found. If the libpython library is referenced from the Python binary, the primary location is the Python binary, and secondary location information includes the libpython library.

• No Python binary is found but a libpython shared library is found. This will continue to surface Python findings, with the primary location of the libpython library.

The reason for the last described case is that there are situations a container may have libpython without a binary -- for example an Apache HTTP Server image with a Python module. In this case, it is important to surface the fact that there may be Python execution with library and version found.

Fixes: #1643
Also fixes: #1646

[wagoodman]

My only blocking comment is the note about mode as an indicator for parsing, other than that 💯 !

[noqcks]

we lost some information on python binaries after this PR:

syft v0.74.0

➜  ~ syft -q python:3.4 | grep binary
python                        2.7.13                          binary
python                        3.4.10                          binary
python                        3.5.3                           binary

syft v0.74.1

➜  ~ syft -q python:3.4 | grep binary
python                        2.7.13                          binary
python                        35                              binary

[kzantow]

@noqcks could you give the json output for those packages between the versions?

[noqcks]

• v0.74.1 - python:3.4
• v0.74.0 - python:3.4

[kzantow]

Thanks for this report @noqcks!

This has led me to uncover a couple issues with the python matching and I've fixed them here: #1667