fix(scan): CPE matching for OpenJDK packages

[luhring]

Syft and Grype don't seem to be handling OpenJDK properly, such that we miss valid vulnerability matches (i.e. false negatives) in our openjdk-* APKs when using Syft and Grype in wolfictl to scan the APK.

This PR implements a potentially viable workaround that lets us discover these vulnerabilities after all.

Before

$ wolfictl scan --disable-sbom-cache =(curl -sS https://packages.wolfi.dev/os/aarch64/openjdk-21-21.0.1-r0.apk)
🔎 Scanning "/tmp/zshp5wsUm"
✅ No vulnerabilities found

After

$ wolfictl scan --disable-sbom-cache =(curl -sS https://packages.wolfi.dev/os/aarch64/openjdk-21-21.0.1-r0.apk)
🔎 Scanning "/tmp/zshryD2h3"
└── 📄 /.PKGINFO
        📦 openjdk-21 21.0.1-r0 (apk)
            High CVE-2024-20918
            Medium CVE-2024-20926
            High CVE-2024-20952