fix: only warn missing CPEs if CPEs wanted

[willmurphyscode]

Previously, a warning would be logged about missing CPEs even when processing packages for which CPEs would never be generated. Instead, return a specific error when attempting to match by CPEs on a package with no CPEs.

This change improves the user experience in 2 ways:

1. The user will only see a warning about missing CPEs if Grype actually tries to search by CPE on a package that has no CPEs, which means the warning is only ever shown if it's affecting matchign
2. The warning contains the package name, so the user has a better ability to try to investigate.

But with the following tradeoff:

1. If the user has a lot of packages missing CPEs for a matcher that has CPE matching turned on, they will see this log line a lot of times.

Fixes #1634

Example runs

Before, even with CPE matching disabled

❯ grype cgr.dev/chainguard/go                                                             
...
[0009]  WARN some package(s) are missing CPEs. This may result in missing vulnerabilities. You may autogenerate these using: --add-cpes-if-none
NAME                INSTALLED  FIXED-IN  TYPE  VULNERABILITY        SEVERITY 
...

After this change, with CPE matching disabled, no warning is printed.

After this change, if when Grype attempts to match on a package by CPEs that has no CPEs, the flag is still suggested:

❯ GRYPE_MATCH_GOLANG_USING_CPES=true go run cmd/grype/main.go willtmp/chainguard.syft.json
...
[0000]  WARN attempted CPE search on cmd/addr2line, which has no CPEs. Consider re-running with --add-cpes-if-none
NAME                INSTALLED  FIXED-IN  TYPE  VULNERABILITY        SEVERITY 
...