Add "Alpine Linux" to IDMapping; handle no CPEs error in findApkPackage.

[aeg]

Even if there are vulnerability scan results for search.ByPackageDistro in apk matcher, if the SBOM does not have a CPE set, the results are ignored and the vulnerability search result becomes empty.

resolves #2039

And amazon Inspector sbom generator genereta this component.

    {
      "bom-ref": "comp-2",
      "type": "operating-system",
      "name": "Alpine Linux",
      "version": "3.17.1"
    }

To make grype recognize this file as Alpine, you need to add the following entry to grype/distro/type.go:
"Alpine Linux": Alpine,

[spiffcs]

Hi @aeg!

Would you be able to sign the DCO for this PR?

Here are the instructions on how to do this:
https://github.com/anchore/grype/pull/2040/checks?check_run_id=28493855535

[spiffcs]

Thanks @aeg - I'm just getting a test written here that covers any regressions in this area - really appreciate the patch 👍

[spiffcs]

@anchore/tools just to reiterate from the issue, this increases grype's vulnerability report for alpine pretty significantly

See the output in the below issue:
#2039

I agree with the fix here since we do NOT want to throw away secDB matches based on a package in an SBOM being scanned (not generated by syft) causing this error if there are no CPE on the package.