Add JVM cataloger (#3217)

* add jvm cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* simplify version selection

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* CPEs from JVM cataloger should be declared

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* ensure package overlap is enabled for sensitive use cases

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* more permissive glob

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

syft/format/internal/spdxutil/helpers/originator_supplier.go

@@ -62,6 +62,10 @@ func Originator(p pkg.Package) (typ string, author string) { //nolint: funlen
 			}
 		}
 
+	case pkg.JavaVMInstallation:
+		typ = orgType
+		author = metadata.Release.Implementor
+
 	case pkg.LinuxKernelModule:
 		author = metadata.Author
 

syft/format/internal/spdxutil/helpers/originator_supplier_test.go

@@ -178,6 +178,18 @@ func Test_OriginatorSupplier(t *testing.T) {
 			},
 			// note: empty!
 		},
+		{
+			name: "from java -- jvm installation",
+			input: pkg.Package{
+				Metadata: pkg.JavaVMInstallation{
+					Release: pkg.JavaVMRelease{
+						Implementor: "Oracle",
+					},
+				},
+			},
+			originator: "Organization: Oracle",
+			supplier:   "Organization: Oracle",
+		},
 		{
 			name: "from linux kernel module",
 			input: pkg.Package{