Add compliance policy for empty name and version

[wagoodman]

Adds a new compliance configuration to handle what to do when there is a missing name or version:

compliance:
  # action to take when a package is missing a name (env: SYFT_COMPLIANCE_MISSING_NAME)
  missing-name: 'drop'
  
  # action to take when a package is missing a version (env: SYFT_COMPLIANCE_MISSING_VERSION)
  missing-version: 'stub'

Above are the default values, but the possible values a user can put in are:

• keep, add a trace log but the non-compliant package is still added to the SBOM
• drop, exclude the package from results, add a debug log
• stub, replace the non-compliant empty value with UNKNOWN

Open questions:

1. configuration-wise should this land within the pkgcataloging package? (instead of the cataloging package?)

Closes #2132
Closes #2652
Closes #2038
Closes #2039

[kzantow]

One observation: once the known-unknowns lands perhaps some of these options would go away / change? E.g. a user could surface something in the files section with something like:

/package.json
  unknowns: dropped package due to missing name

[spiffcs]

I think the config placement and package organization is correct here from and API standpoint so 🟢 from me. Was there any other discussion you wanted @wagoodman on this PR?