Include container information in SPDX

[kzantow]

What would you like to be added:
For container scans, SPDX output should contain a container package (with Primary Package Purpose set to CONTAINER), which is what the SPDXRef-DOCUMENT DESCRIBES relationship should point to.

Packages found within the container should have CONTAINS relationships from the container.

While investigating this, it would be good to understand if packages for each layer within the container should be added in between. It seems both tern and the k8s bom tool generate SPDX from containers in this fashion: e.g. the SPDX relationships build a graph like: container -> layer -> package

Why is this needed:
More closely align with other tools and standards.

[kzantow]

Discussion resulted in this initial change will not include layer information for a number of reasons, primarily:

• Syft by default uses a squashed scope, so it will not necessarily include all the layer information
• Syft currently results in packages showing up only in the last layer they are located in
• This makes dir/file scans result in the same document structure as container scans

[eliaslevy]

#1241 appears to be a duplicate of this issue.

[lumjjb]

👋, just checking in and wondering what the status of these discussions are if there are any updates!

[kzantow]

Closing this as a duplicate of #1241