config: add config opt in golang pseudo version main module comparison

[spiffcs]

Summary

Add a new config option for grype to NOT allow module comparison when there is a pseudo version and main module.

The default for this value is true, but users have the option to disable in case FP introductions are too high.

Config Additions

match:
  golang:
    using-cpes: false
    # even if CPE matching is disabled, make an exception when scanning for "stdlib".
    always-use-cpe-for-stdlib: true
    allow-main-module-pseudo-version-comparison: true

Env Variable Addition:

GRYPE_MATCH_GOLANG_ALLOW_MAIN_MODULE_PSEUDO_VERSION_COMPARISON

Testing on your local

Example of FP introduced when comparing pseudo versions of main modules

export GRYPE_MATCH_GOLANG_ALLOW_MAIN_MODULE_PSEUDO_VERSION_COMPARISON=true
syft -o json ollama/ollama:0.1.32 | go run cmd/grype/main.go

------

github.com/ollama/ollama    v0.0.0-20240414223325-7027f264fbb3  0.1.29             go-module  GHSA-5jx5-hqx5-2vrj  High

Example of using the ENV VAR to disable this behavior

export GRYPE_MATCH_GOLANG_ALLOW_MAIN_MODULE_PSEUDO_VERSION_COMPARISON=false
syft -o json ollama/ollama:0.1.32 | go run cmd/grype/main.go

------

NO RESULT