fix(sbom): preserve OS packages from multiple SBOMs

[knqyf263]

Overview

This PR fixes a bug in the SBOM analyzer where OS packages from multiple SBOM files were being overwritten during the merge process.

Usage

No changes in usage. This is a bug fix in how Trivy handles OS packages from multiple SBOM files.

Description

When scanning container images with multiple SBOM files containing OS packages, only the packages from the last processed SBOM remained in the final result. This was because OS packages didn't have a file path set, causing them to be overwritten during the merge process.

This PR fixes the issue by:

1. Setting the SBOM file path as the package file path for OS packages
2. This ensures packages from different SBOMs are preserved as distinct entries

For example, when scanning an image with these SBOM files:

• /opt/bitnami/debian/.spdx-ca-certificates.spdx
• /opt/bitnami/debian/.spdx-tzdata.spdx
• /opt/bitnami/debian/.spdx-netbase.spdx

All OS packages will now be correctly preserved in the final result.

Related Issues

• fix(sbom): set file path for OS packages in SBOM analyzer #8324

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

LGTM

[DmitriyLewen]

@aqua-bot backport release/v0.59

[aqua-bot]

Backport PR created: #8333