Add support for parsing .NET assemblies

[luhring]

Today, to learn about installed .NET software, Syft parses *.deps.json files it discovers on the filesystem. This approach is incorrect, and it leads to Syft surfacing incorrect data about what's installed, which also leads to false positives in Grype.

This PR adds a new cataloger and parser to parse .NET assemblies themselves — which are Portable Executables — to find the correct name, version, and other metadata for the software installed on disk.

Fixes: #1799

Here's a new Syft scan of the image referenced in that bug report:

$ go run ./cmd/syft -q cgr.dev/chainguard/dotnet-sdk:7 | grep 'System\.Net\.Http'
System.Net.Http                                                 7.0.923.36201     dotnet
...

Here we see a version that we'd expect (7.0.*), given that we know .NET 7 is what's installed in this image.

[wagoodman]

Seems like there are a few CLI test failures (adding the snippet here since the log goes on for a while):

--- FAIL: TestPackagesCmdFlags (19.62s)
...
    --- FAIL: TestPackagesCmdFlags/squashed-scope-flag (0.11s)
...
    --- FAIL: TestPackagesCmdFlags/override-default-parallelism (0.16s)
    --- FAIL: TestPackagesCmdFlags/default-parallelism (0.17s)
    --- FAIL: TestPackagesCmdFlags/password_and_key_not_in_config_output (0.17s)

[luhring]

Seems like there are a few CLI test failures (adding the snippet here since the log goes on for a while):

Hmm I'm seeing CLI test failures on main as well 🤔 I think it's the same set of tests that are failing on my branch