feat: match against debian unstable

[willmurphyscode]

Fixes #1446

Works by special casing debian:unstable to skip semver creation / parsing in a couple of places.

Manual testing done

(go run cmd/grype/main.go is this change, grype is v0.73.0 from homebrew)

from the original issue

❯ go run cmd/grype/main.go r-base:latest
 ✔ Vulnerability DB                [no update available]
 ✔ Loaded image                                                                                                                                                                                                                                                                                                                                           r-base:latest
 ✔ Parsed image                                                                                                                                                                                                                                                                                 sha256:b49a24a003b91ee33a171c5491fb3add7152c7bb5e928d9d69f0e7fde7bff638
 ✔ Cataloged packages              [301 packages]
 ✔ Scanned for vulnerabilities     [284 vulnerability matches]
   ├── by severity: 3 critical, 23 high, 22 medium, 5 low, 224 negligible (7 unknown)
   └── by status:   30 fixed, 254 not-fixed, 0 ignored
NAME                        INSTALLED          FIXED-IN      TYPE  VULNERABILITY     SEVERITY
apt                         2.7.6                            deb   CVE-2011-3374     Negligible
binutils                    2.41-5                           deb   CVE-2021-32256    Negligible
binutils                    2.41-5                           deb   CVE-2018-9996     Negligible
binutils                    2.41-5                           deb   CVE-2018-20712    Negligible
... snip

❯ go run cmd/grype/main.go r-base:latest | wc -l
... snip
     285

testing against debian:testing directly

❯ go run cmd/grype/main.go -q -o json debian:testing | jq '.matches[0].vulnerability.namespace'
"debian:distro:debian:unstable"

❯ go run cmd/grype/main.go debian:testing
 ✔ Vulnerability DB                [no update available]
 ✔ Loaded image                                                                                                                                                                                                                                                                                                                                          debian:testing
 ✔ Parsed image                                                                                                                                                                                                                                                                                 sha256:0450fd13eb205233d4ad56781f0018843029ac48b8f40172a7378edd88562857
 ✔ Cataloged packages              [87 packages]
 ✔ Scanned for vulnerabilities     [46 vulnerability matches]
   ├── by severity: 1 critical, 1 high, 0 medium, 1 low, 43 negligible
   └── by status:   0 fixed, 46 not-fixed, 0 ignored
NAME           INSTALLED        FIXED-IN  TYPE  VULNERABILITY     SEVERITY
apt            2.7.6                      deb   CVE-2011-3374     Negligible
bsdutils       1:2.39.2-4                 deb   CVE-2022-0563     Negligible
coreutils      9.1-1                      deb   CVE-2016-2781     Low
... snip

As opposed to:

❯ grype debian:testing
 ✔ Vulnerability DB                [no update available]
 ✔ Loaded image                                                                                                                                                                                                                                                                                                                                          debian:testing
 ✔ Parsed image                                                                                                                                                                                                                                                                                 sha256:0450fd13eb205233d4ad56781f0018843029ac48b8f40172a7378edd88562857
 ✔ Cataloged packages              [87 packages]
 ✔ Scanned for vulnerabilities     [0 vulnerability matches]
   ├── by severity: 0 critical, 0 high, 0 medium, 0 low, 0 negligible
   └── by status:   0 fixed, 0 not-fixed, 0 ignored
No vulnerabilities found

[westonsteimel]

I've also verified this gets the expected results on some test images