fix: prevent panics on malformed parser inputs

[123kaze]

Description

Closes #10976.

Several parsers and the Amazon Linux detector indexed the first element returned by strings.Fields or another tokenization step without first checking whether any tokens existed. Malformed but container-valid input could therefore panic and abort the entire scan.

This change handles each malformed value at the boundary where its format is understood:

• rejects an Amazon Linux release string that does not contain version information;
• centralizes defensive Amazon Linux version normalization for Detect and IsSupportedVersion;
• skips empty, whitespace-only, or operators-only entries in pyproject.toml dependencies;
• skips empty or whitespace-only CocoaPods child dependencies while preserving valid siblings;
• handles a Mix dependency with an empty body without indexing an empty token slice;
• ignores a blank six-space Bundler dependency line while preserving package line locations.

Each parser keeps its existing behavior for valid input. The checks remain local because the four dependency formats have different parsing rules and malformed-entry policies.

Before

Any of the malformed inputs described in #10976 could cause runtime error: index out of range [0] with length 0 and terminate the scan.

After

The Amazon Linux analyzer reports its normal OS analysis error when required version information is absent. Direct Amazon detector calls also return safely. The dependency parsers skip only the malformed entry and continue parsing valid content.

Validation

• regression tests first reproduced all five panic paths
• targeted tests for the Amazon analyzer/detector and all four dependency parsers
• mage tidy
• mage fmt
• mage build
• mage docs:generate
• mage lint:run (0 issues)
• mage test:unit
• git diff --check

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the PR title conventions.
• I've added tests that prove the fix is effective.
• Documentation changes are not needed because this only changes malformed-input handling.
• Usage information is not needed because this introduces no new options.
• The before-and-after behavior is included above.

[CLAassistant]

All committers have signed the CLA.