fix(sbom,scan): binary package filtering

[luhring]

Fixes #355

This provides better parity with actual Syft and Grype scans, since "binary" packages owned by the APK package are removed when the ExcludeBinaryPackagesWithFileOwnershipOverlap option is enabled.

cc: @hectorj2f @cpanato

Re: tests: We'll add integration tests to verify this behavior in another PR that conveniently I'm working on at the moment!

This updates the behavior for both SBOM generation and vulnerability scanning:

wolfictl sbom

Before

go run . sbom --disable-sbom-cache ./packages/x86_64/openssl-3.3.0-r9.apk
🔎 Scanning "./packages/x86_64/openssl-3.3.0-r9.apk"
├── 📄 /.PKGINFO
│       📦 openssl 3.3.0-r9 (apk)
│
└── 📄 /usr/bin/openssl
        📦 openssl 3.3.0 (binary)

After

$ go run . sbom --disable-sbom-cache ./packages/x86_64/openssl-3.3.0-r9.apk    
🔎 Scanning "./packages/x86_64/openssl-3.3.0-r9.apk"
└── 📄 /.PKGINFO
        📦 openssl 3.3.0-r9 (apk)

wolfictl scan

Before

$ go run . scan -r openssl --disable-sbom-cache
📡 Finding remote packages
🔎 Scanning "/var/folders/pz/h07rtjmd4mv4wpnr5st5q1480000gn/T/x86_64-openssl-3.3.0-r9-846198202.apk"
└── 📄 /usr/bin/openssl
        📦 openssl 3.3.0 (binary)
            Unknown CVE-2024-4603
 
🔎 Scanning "/var/folders/pz/h07rtjmd4mv4wpnr5st5q1480000gn/T/aarch64-openssl-3.3.0-r9-2055496375.apk"
└── 📄 /usr/bin/openssl
        📦 openssl 3.3.0 (binary)
            Unknown CVE-2024-4603

After

$  go run . scan -r openssl --disable-sbom-cache                            
📡 Finding remote packages
🔎 Scanning "/var/folders/pz/h07rtjmd4mv4wpnr5st5q1480000gn/T/x86_64-openssl-3.3.0-r9-3675836449.apk"
✅ No vulnerabilities found
🔎 Scanning "/var/folders/pz/h07rtjmd4mv4wpnr5st5q1480000gn/T/aarch64-openssl-3.3.0-r9-117921744.apk"
✅ No vulnerabilities found

[hectorj2f]

I've found a bit more context of this flag in here: anchore/syft#931. If anyone is reviewing this PR.

[hectorj2f]

lgtm, looking forward to review these tests.