fix: default image source name to user input

[kzantow]

This change ensures that there is always a source name based on user input. This causes fun conflict with the SPDX tag-value decoder when you've encoded a package with no name (error: unable to decode spdx-tag-value: received unknown tag SPDXID in CreationInfo section).

Found this in anchore/grype#1410 for all spdx-tag-value tests:

=== RUN   TestCompareSBOMInputToLibResults/npm-spdx-tag-value
    compare_sbom_input_vs_lib_test.go:244: 
        	Error Trace:	/home/runner/work/grype/grype/test/integration/compare_sbom_input_vs_lib_test.go:244
        	Error:      	Received unexpected error:
        	            	unable to decode sbom: unable to identify format
        	Test:       	TestCompareSBOMInputToLibResults/npm-spdx-tag-value