Handle GOEXPERIMENTs in go version

[jonjohnsonjr]

See anchore/grype#1851 for more context.

I was originally going to put this into scanFile, but the existing tests made it a little easier to test if I did it in parse_go_binary.go instead.

I've also tested this manually, before:

$ git checkout main && go install ./cmd/syft && syft ghcr.io/projectcontour/contour | grep stdlib
Switched to branch 'main'
Your branch is up to date with 'origin/main'.
 ✔ Loaded image                                                                                                                                                                                                         ghcr.io/projectcontour/contour:latest
 ✔ Parsed image                                                                                                                                                                       sha256:3538357182affbd790c9ecaffc62c3022d8e2cc46816eaa8a8fb8acb1a82ad8b
 ✔ Cataloged contents                                                                                                                                                                        bd7b5d7ab8063fa560c1164fbfea7cb4d6b90cc61b534bc2720f34f80d18db18
   ├── ✔ Packages                        [73 packages]
   └── ✔ Executables                     [1 executables]
stdlib                                              go1.22.2 X:nocoverageredesign,noallocheaders,noexectracer2  go-module

And after:

$ git checkout go-experiments && go install ./cmd/syft && syft ghcr.io/projectcontour/contour | grep stdlib
Switched to branch 'go-experiments'
 ✔ Loaded image                                                                                                                                                                                                         ghcr.io/projectcontour/contour:latest
 ✔ Parsed image                                                                                                                                                                       sha256:3538357182affbd790c9ecaffc62c3022d8e2cc46816eaa8a8fb8acb1a82ad8b
 ✔ Cataloged contents                                                                                                                                                                        bd7b5d7ab8063fa560c1164fbfea7cb4d6b90cc61b534bc2720f34f80d18db18
   ├── ✔ Packages                        [73 packages]
   └── ✔ Executables                     [1 executables]
stdlib                                              go1.22.2                               go-module

I can also confirm that after modifying grype to use my branch, it no longer emits a warning:

$ git diff | head
diff --git a/go.mod b/go.mod
index 4116608..2852d36 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module github.com/anchore/grype

 go 1.21.1

+replace github.com/anchore/syft => ../syft
+

$ grype ghcr.io/projectcontour/contour
 ✔ Vulnerability DB                [updated]
 ✔ Loaded image                                                                                                                                                                                                         ghcr.io/projectcontour/contour:latest
 ✔ Parsed image                                                                                                                                                                       sha256:3538357182affbd790c9ecaffc62c3022d8e2cc46816eaa8a8fb8acb1a82ad8b
 ✔ Cataloged contents                                                                                                                                                                        bd7b5d7ab8063fa560c1164fbfea7cb4d6b90cc61b534bc2720f34f80d18db18
   ├── ✔ Packages                        [73 packages]
   └── ✔ Executables                     [1 executables]
 ✔ Scanned for vulnerabilities     [2 vulnerability matches]
   ├── by severity: 0 critical, 0 high, 0 medium, 0 low, 0 negligible (2 unknown)
   └── by status:   0 fixed, 2 not-fixed, 0 ignored
NAME    INSTALLED  FIXED-IN  TYPE       VULNERABILITY   SEVERITY
stdlib  go1.22.2             go-module  CVE-2024-24788  Unknown
stdlib  go1.22.2             go-module  CVE-2024-24787  Unknown

Interestingly, grype still picks up these CVEs even without my change, so maybe this warning isn't all that necessary? I don't have a super firm grasp on how this works.

$ git checkout -- . && go install ./cmd/grype && grype ghcr.io/projectcontour/contour
 ✔ Vulnerability DB                [no update available]
 ✔ Loaded image                                                                                                                                                                                                         ghcr.io/projectcontour/contour:latest
 ✔ Parsed image                                                                                                                                                                       sha256:3538357182affbd790c9ecaffc62c3022d8e2cc46816eaa8a8fb8acb1a82ad8b
 ✔ Cataloged contents                                                                                                                                                                        bd7b5d7ab8063fa560c1164fbfea7cb4d6b90cc61b534bc2720f34f80d18db18
   ├── ✔ Packages                        [73 packages]
   └── ✔ Executables                     [1 executables]
 ✔ Scanned for vulnerabilities     [2 vulnerability matches]
   ├── by severity: 0 critical, 0 high, 0 medium, 0 low, 0 negligible (2 unknown)
   └── by status:   0 fixed, 2 not-fixed, 0 ignored
[0000]  WARN could not match by package language (package=Pkg(type=go-module, name=stdlib, version=go1.22.2 X:nocoverageredesign,noallocheaders,noexectracer2, upstreams=0)): matcher failed to parse version pkg="stdlib" ver="go1.22.2 X:nocoverageredesign,n
NAME    INSTALLED                                                   FIXED-IN  TYPE       VULNERABILITY   SEVERITY
stdlib  go1.22.2 X:nocoverageredesign,noallocheaders,noexectracer2            go-module  CVE-2024-24788  Unknown
stdlib  go1.22.2 X:nocoverageredesign,noallocheaders,noexectracer2            go-module  CVE-2024-24787  Unknown

[wagoodman]

I'm about to merge another PR that will cause a conflict -- I can go ahead and rebase this and get it in just after that 👍

[wagoodman]

I rarely have experiments enabled, so this snuck by -- thanks for the fix 🙌 !