Change Indirect field to be an ENUM instead of Bool

[john-d8r]

Description

Trivy has the ability to detect whether a package is Indirect, for various languages like Node.js (lock files), PHP etc..

There are conditions where trivy can't give this info for supported languages. For example

1. when scanning composer.lock and there is no composer.json in the folder or if trivy was not able to detect it Indirect info not being populated for php image scans #5726
2. when scanning yarn.lock and there is no package.json in the folder
3. when scanning package-locks.json v1
   and so on...

Would it make sense to change Indirect field to be an ENUM and show the same in JSON report
e.g. Indirect: "not_detected" or Indirect: "composer.json not found"

Currently we get only have an debug log
DEBUG Unable to determine the direct dependencies: manifest/composer.json not found

Target

SBOM

Scanner

Vulnerability

[knqyf263]

Thanks. Created #6092 for tracking.