feat(php): add installed.json file support

[DmitriyLewen]

Description

Add installed.json file support.
Supported modes - image and rootfs.

Scanning composer.lock files is only possible in fs and repo modes now

Example of work:

➜  ./trivy rootfs ./installed.json 
2023-08-29T13:24:06.376+0600    INFO    Vulnerability scanning is enabled
2023-08-29T13:24:06.376+0600    INFO    Secret scanning is enabled
2023-08-29T13:24:06.376+0600    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-08-29T13:24:06.376+0600    INFO    Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection
2023-08-29T13:24:06.387+0600    INFO    Number of language-specific files: 1
2023-08-29T13:24:06.387+0600    INFO    Detecting composer-installed vulnerabilities...

installed.json (composer-installed)

Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 0, CRITICAL: 0)

┌─────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────┐
│     Library     │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                       Title                        │
├─────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────┤
│ guzzlehttp/psr7 │ CVE-2022-24775 │ MEDIUM   │ fixed  │ 1.8.3             │ 1.8.4, 2.1.1  │ Improper Input Validation in guzzlehttp/psr7       │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2022-24775         │
│                 ├────────────────┤          │        │                   ├───────────────┼────────────────────────────────────────────────────┤
│                 │ CVE-2023-29197 │          │        │                   │ 1.9.1, 2.4.5  │ Improper header name validation in guzzlehttp/psr7 │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-29197         │
└─────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────┘

Related Issues:

• Close feat(php): add installed.json files support #5057

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[github-actions]

This PR is stale because it has been labeled with inactivity.

[github-actions]

This PR is stale because it has been labeled with inactivity.

[github-actions]

This PR is stale because it has been labeled with inactivity.

[github-actions]

This PR is stale because it has been labeled with inactivity.

[knqyf263]

Sorry to be late

[knqyf263]

How about composer-vendor?

Suggested change

	TypeComposerInstalled Type = "composer-installed"
	TypeComposerInstalled Type = "composer-vendor"

[DmitriyLewen]

intalled.json file placed in path_to_app/vendor/... dir.
So it make sense.
Updated.

[knqyf263]

I think this file should be located under php/composer as installed.json is a composer-specific file.

[DmitriyLewen]

moved