cmd/osv-scanner: fix AlmaLinux image scanning to detect ALSA vulnerabilities

Two root causes were found that prevented ALSA advisories from being detected
when scanning AlmaLinux container images:

1. RPM extractor was missing from the "artifact" preset (presets.go):
   The image scan uses the "artifact" extractor preset which included apk
   (Alpine), dpkg (Debian/Ubuntu), chisel, and homebrew — but NOT the rpm
   extractor. This caused all RPM packages (curl-minimal, openssl, bash, etc.)
   from AlmaLinux images to be completely ignored.

2. AlmaLinux ecosystem suffix was using full VERSION_ID instead of major only:
   /etc/os-release in almalinux:9.0 sets VERSION_ID="9.0", producing ecosystem
   "AlmaLinux:9.0". OSV.dev keys ALSA advisories by major version only
   ("AlmaLinux:9"), so zero advisories were matched. This is fixed upstream in
   google/osv-scalibr#2250; this PR includes a go.mod replace directive to
   pick up that fix while the upstream PR is reviewed.

With both fixes applied, scanning almalinux:9.0 now correctly produces:
  AlmaLinux:9 | 68 packages | 282 known vulnerabilities from 2 ecosystems
  curl-minimal 7.76.1-14.el9_0.5 → 12 vulnerabilities including ALSA advisories

Fixes #2870 (responds to @michaelkedar review)
Depends on google/osv-scalibr#2250 (ecosystem suffix trim)

Author: herdiyana256