added verification for dockerfile and spdx detector, minor bug fixes

[RushabhBhansali]

• Enabled verification tests for DockerReference and SPDX22SBOM detectors
• minor bug fix in DockerRefernce detection that detected Repository kind as canonical.
• bug fix in de-serialization of "spdx" component during verification tests.

Note: verification tests are expected to fail because new detectors are enabled in this PR.

[JamieMagee]

Two points:

It looks like the serialization of SPDX components is wrong. They're all serialized as

Expected foundComponent to be true because The component for SPDX22SBOM--- was not present in the old manifest file. Verify this is expected behavior before proceeding, but found False.

I'd expect a name and version in the output.

Secondly, I'd rather some more targeted Dockerfiles to test with i.e. testing each different reference type, testing AS statements, testing variable resolutions.

FROM ubuntu AS base

FROM base

or

ARG tag
FROM ubuntu:${tag} as base

FROM base

[RushabhBhansali]

It looks like the serialization of SPDX components is wrong. They're all serialized as

Expected foundComponent to be true because The component for SPDX22SBOM--- was not present in the old manifest file. Verify this is expected behavior before proceeding, but found False.

I'd expect a name and version in the output.

Fixed it by addiing setter in SpdxComponent class.

[RushabhBhansali]

Secondly, I'd rather some more targeted Dockerfiles to test with i.e. testing each different reference type, testing AS statements, testing variable resolutions.

I have covered Canonical = 0, Tagged = 2, Dual = 3, Digest = 4, in the existing examples in the PR. Only Respository = 1 is not reproducible because if I don't provide domain in the dockerfile, code deafults it to docker.io/ and its identified as canonical.

added python,dockerfile to identify

FROM ubuntu AS base

FROM base

pattern.