Add internal cataloger capability descriptions

[wagoodman]

This adds the ability, when SYFT_EXP_CAPABILITIES=true, to use an internal syft cataloger info command to describe cataloger capabilities such as:

• what catalogers exist
• what globs / evidence are searched for
• if a cataloger finds licenses
• if a cataloger detects particular package manager claims (listing of files, digests, package integrity hash)
• what dependencies (if any) can be detected (depth of nodes, topology of the edges, and kinds of dependencies included)
• what API and app-level configurations exist for each cataloger

This is available via an ascii table and JSON output.

Caution

This is an experimental feature and can change without warning and could be removed entirely. Do not depend on this command in production.

The way the capabilities are tracked is described in depth in the internal tooling's readme.

A quick summary is that we use the source code and test observations as a basis for what catalogers exist, how they are configured, and what they output. These things are then used to cross-validate a pseudo-generated packages.yaml (some auto generated items, some manually filled in items) with a set of completion tests (tests that ensure the full universe of things are defined and self-consistent) and then used to drive the cataloger info command.