Add support for Tuist's .package.resolved SPM lockfile

[patriknordlen]

Description

Trivy's Swift analyzer matches lockfiles strictly by filename — only Package.resolved qualifies.
In Tuist projects, the SPM lockfile is committed as .package.resolved, so Trivy silently skips it and reports no Swift dependencies for those repos.

Proposed fix

Recognize .package.resolved alongside Package.resolved in the analyzer's Required() check. No parser changes are needed since the format is identical. Happy to send a PR.

Target

Filesystem

Scanner

Vulnerability