fix: update java cataloger to include similar child packages, correct PURL, and correct GroupID

[spiffcs]

Summary

This PR aims to improve 3 related aspects of syft's java cataloging.

1. Improve PURL generation. In some cases syft is appending the artifact ID to the middle section (GroupID) of a PURL
   a. EX: pkg:maven/org.apache.xalan/[email protected] should be pkg:maven/org.apache/[email protected]

2. Improve GroupID detection. Currently syft does not use any hierarchy for GroupID detection and treats all sources as equal. It does already treat fields from files with priority. We should try to obtain a GroupID answer from Pom Properties, then the Pom Project and finally, if a GroupID has not been found, the Manifest. Manifest should not return an answer if one was found in PomProject was, and PomProject should not return a GroupID answer if PomProperties found one.

3. Syft eliminates java packages as duplicates if the package names match. With the enhanced GroupID detection we can extend this duplicate elimination to make sure syft is not eliminating packages with similar names, but different GroupID.

   • Reviewers of this PR will notice that there has been an update in how the virtual path is expressed on the java metadata. This is a consequence of new java packages being added when before they were incorrectly deduped, . Rather than vPathSuffix += ":" + pomProperties.ArtifactID, which just uses the ArtifactID, SBOM consumers will see the full path of the package's properties used for package creation Ex: META-INF/maven/org.glassfish.jaxb/jaxb-core/pom.properties. This allows for better identification for child packages that look identical, but are actually forks or similar clones:
     • Previously: /casb.war:WEB-INF/lib/jaxb-core-2.2.11.jar:jaxb-core
     • Now:/casb.war:WEB-INF/lib/jaxb-core-2.2.11.jar:META-INF/maven/org.glassfish.jaxb/jaxb-core

[github-actions]

Benchmark Test Results

Benchmark results from the latest changes vs base branch

goos: linux%0Agoarch: amd64%0Apkg: github.com/anchore/syft/test/integration%0Acpu: Intel(R) Xeon(R) Platinum 8370C CPU @ 2.80GHz%0A                                                              │ ./.tmp/benchmark-64a1f93.txt │%0A                                                              │            sec/op            │%0AImagePackageCatalogers/alpmdb-cataloger-2                                       12.12m ±  1%25%0AImagePackageCatalogers/apkdb-cataloger-2                                        671.5µ ±  5%25%0AImagePackageCatalogers/binary-cataloger-2                                       203.2µ ±  1%25%0AImagePackageCatalogers/dpkgdb-cataloger-2                                       558.5µ ±  1%25%0AImagePackageCatalogers/dotnet-portable-executable-cataloger-2                   20.82µ ±  1%25%0AImagePackageCatalogers/go-module-binary-cataloger-2                             91.54µ ±  0%25%0AImagePackageCatalogers/java-cataloger-2                                         13.29m ±  0%25%0AImagePackageCatalogers/graalvm-native-image-cataloger-2                         91.54µ ± 15%25%0AImagePackageCatalogers/javascript-package-cataloger-2                           345.2µ ±  1%25%0AImagePackageCatalogers/nix-store-cataloger-2                                    252.3µ ±  1%25%0AImagePackageCatalogers/php-composer-installed-cataloger-2                       741.0µ ±  1%25%0AImagePackageCatalogers/portage-cataloger-2                                      416.9µ ±  1%25%0AImagePackageCatalogers/python-package-cataloger-2                               3.160m ±  1%25%0AImagePackageCatalogers/r-package-cataloger-2                                    177.4µ ±  2%25%0AImagePackageCatalogers/rpm-db-cataloger-2                                       473.9µ ±  2%25%0AImagePackageCatalogers/ruby-gemspec-cataloger-2                                 839.9µ ±  0%25%0AImagePackageCatalogers/sbom-cataloger-2                                         116.1µ ±  0%25%0Ageomean                                                                         454.2µ%0A%0A                                                              │ ./.tmp/benchmark-64a1f93.txt │%0A                                                              │             B/op             │%0AImagePackageCatalogers/alpmdb-cataloger-2                                       5.142Mi ± 0%25%0AImagePackageCatalogers/apkdb-cataloger-2                                        205.2Ki ± 0%25%0AImagePackageCatalogers/binary-cataloger-2                                       30.55Ki ± 0%25%0AImagePackageCatalogers/dpkgdb-cataloger-2                                       172.8Ki ± 0%25%0AImagePackageCatalogers/dotnet-portable-executable-cataloger-2                   3.697Ki ± 0%25%0AImagePackageCatalogers/go-module-binary-cataloger-2                             9.906Ki ± 0%25%0AImagePackageCatalogers/java-cataloger-2                                         2.821Mi ± 0%25%0AImagePackageCatalogers/graalvm-native-image-cataloger-2                         8.594Ki ± 0%25%0AImagePackageCatalogers/javascript-package-cataloger-2                           94.36Ki ± 0%25%0AImagePackageCatalogers/nix-store-cataloger-2                                    49.33Ki ± 0%25%0AImagePackageCatalogers/php-composer-installed-cataloger-2                       186.4Ki ± 0%25%0AImagePackageCatalogers/portage-cataloger-2                                      120.2Ki ± 0%25%0AImagePackageCatalogers/python-package-cataloger-2                               1.004Mi ± 0%25%0AImagePackageCatalogers/r-package-cataloger-2                                    53.29Ki ± 0%25%0AImagePackageCatalogers/rpm-db-cataloger-2                                       181.5Ki ± 0%25%0AImagePackageCatalogers/ruby-gemspec-cataloger-2                                 144.1Ki ± 0%25%0AImagePackageCatalogers/sbom-cataloger-2                                         14.20Ki ± 0%25%0Ageomean                                                                         100.6Ki%0A%0A                                                              │ ./.tmp/benchmark-64a1f93.txt │%0A                                                              │          allocs/op           │%0AImagePackageCatalogers/alpmdb-cataloger-2                                        88.14k ± 0%25%0AImagePackageCatalogers/apkdb-cataloger-2                                         4.190k ± 0%25%0AImagePackageCatalogers/binary-cataloger-2                                         848.0 ± 0%25%0AImagePackageCatalogers/dpkgdb-cataloger-2                                        3.145k ± 0%25%0AImagePackageCatalogers/dotnet-portable-executable-cataloger-2                     132.0 ± 0%25%0AImagePackageCatalogers/go-module-binary-cataloger-2                               281.0 ± 0%25%0AImagePackageCatalogers/java-cataloger-2                                          40.59k ± 0%25%0AImagePackageCatalogers/graalvm-native-image-cataloger-2                           228.0 ± 0%25%0AImagePackageCatalogers/javascript-package-cataloger-2                            1.342k ± 0%25%0AImagePackageCatalogers/nix-store-cataloger-2                                      898.0 ± 0%25%0AImagePackageCatalogers/php-composer-installed-cataloger-2                        4.079k ± 0%25%0AImagePackageCatalogers/portage-cataloger-2                                       2.272k ± 0%25%0AImagePackageCatalogers/python-package-cataloger-2                                16.45k ± 0%25%0AImagePackageCatalogers/r-package-cataloger-2                                      929.0 ± 0%25%0AImagePackageCatalogers/rpm-db-cataloger-2                                        3.992k ± 0%25%0AImagePackageCatalogers/ruby-gemspec-cataloger-2                                  2.447k ± 0%25%0AImagePackageCatalogers/sbom-cataloger-2                                           394.0 ± 0%25%0Ageomean                                                                          2.063k

[spiffcs]

Splitting this into two PR and merging in upstream fixes from #2032