Add PKGID (SIGMD5) support to RPM cataloger #4650
Description
What would you like to be added:
Expose the RPM PKGID (RPMTAG_SIGMD5, tag 261) in syft's RPM package metadata output.
Why is this needed:
PKGID is the MD5 digest of the combined RPM header and payload contents. It is the package-level content checksum used by RPM to uniquely identify a specific package build.
Syft already exposes RPM signing signatures (RPMTAG_PGP / RPMTAG_RSAHEADER) via the Signatures field, but these are absent for unsigned packages — such as internally built or legacy RPMs. In those cases, PKGID is the only available identifier for integrity verification.
Additional context:
The data is already available in github.com/anchore/go-rpmdb.