fix(sbom): attach nested packages to Application

[DmitriyLewen]

Description

There is a problem with decoding nested packages.
We create 2 attachments for them (see #8143).

This PR recursively checks all related packages and associates them with an attachment.

Example (test file packages:
Before:

➜ trivy -q rootfs -f cyclonedx -o report.cdx.json ./pkg/dependency/parser/golang/binary/testdata/test.elf && trivy -q sbom ./report.cdx.json -f json --list-all-pkgs | grep Target 
      "Target": "",
      "Target": "test.elf",

After:

➜ trivy -q rootfs -f cyclonedx -o report.cdx.json ./pkg/dependency/parser/golang/binary/testdata/test.elf && ./trivy -q sbom ./report.cdx.json -f json --list-all-pkgs | grep Target
      "Target": "test.elf",

Related issues

• Close bug(sbom): multiple Results for one package with root relationship for sbom mode #8143

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

@DmitriyLewen I've added three changes to prevent potential issues:

1. Recursive Processing for OS Packages:
   • Added recursive processing for OS packages to prevent future bugs
   • This preemptive change ensures consistency with language-specific package handling
   • Without this change, future modifications to OS package handling could lead to incomplete dependency resolution

2. Infinite Loop Prevention:

• Implemented cycle detection using a visited packages map
• Each package is now processed only once to prevent infinite recursion

3. Package Duplication Resolution:

• Previous versions of Trivy could output SBOMs where the same package appears multiple times in the dependency tree
• This was due to packages with unknown relationships being added under applications (This behavior was changed in fix(sbom): use root package for unknown dependencies (if exists) #8104)
• The cycle detection mechanism (change No.2) also resolves this package duplication issue

Please verify these changes maintain the expected behavior while addressing the identified issues.

[DmitriyLewen]

Thank you for handling the OS packages.
I didn't think about them.

Looks good now 👍

Please verify these changes maintain the expected behavior while addressing the identified issues.

It works as expected.
Approve the PR if you have no other changes.

[DmitriyLewen]

@aqua-bot backport release/v0.58

[aqua-bot]

Backport PR created: #8168