#6 added support for finding associated files for packages.
However, this won't work with new SPDXs generated by syft, since the hasFiles field is deprecated. To get this same information we need to traverse all the relationship data to recreate this same view that we had before.
