fix(binary): detect envoy 1.37.1 and 1.40.x binaries (#5476)

Motivation: the envoy binary classifier returns no package for envoy 1.37.1,
1.40.0 and 1.40.1 (the official envoyproxy/envoy images), while neighbouring
versions such as 1.37.0 and 1.38.0 are detected.

Approach:
- the main matcher (NUL-delimited version followed by
  envoy_reloadable_features) only accepted 1.3x; widen it to 1.[34]x, which
  covers 1.40.0 and 1.40.1.
- in the 1.37.1 binary the version string sits between different neighbouring
  strings, so the existing matchers do not fire. Add a matcher anchored on the
  preceding "DeltaDiscoveryResponse.removed_resources" string.
- add snippets, config.yaml entries and test cases for 1.37.1, 1.40.0, 1.40.1
  (linux/amd64 images, pinned by digest).

Validation:
- cd syft/pkg/cataloger/binary && go test . -run
  'Test_Cataloger_PositiveCases/envoy' : the three new fixtures fail without
  the classifiers.go change and all envoy cases pass with it.
- golangci-lint run ./syft/pkg/cataloger/binary/... : 0 issues.
- Built syft before/after and scanned the full linux/arm64 envoy binaries from
  the official images: 1.37.1, 1.40.0 and 1.40.1 were not reported before and
  are reported with the right version after; 1.37.0 and 1.38.0 are unchanged.
- Not run: the rest of the package test suite needs docker, which is not
  available here (Test_PEPackageCataloger etc.), and snippets for other
  binaries are not downloaded locally.

The contrib-build fallback matchers still only accept 1.3x; they are untouched.

Report: https://github.com/anchore/syft/issues/5470

Assisted-by: claude-sonnet-5-5 (via Claude Code)

Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>

syft/pkg/cataloger/binary/classifier_cataloger_test.go

@@ -2629,6 +2629,39 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("grafana-binary"),
 			},
 		},
+		{
+			logicalFixture: "envoy/1.40.1/linux-amd64",
+			expected: pkg.Package{
+				Name:      "envoy",
+				Version:   "1.40.1",
+				Type:      "binary",
+				PURL:      "pkg:generic/envoy@1.40.1",
+				Locations: locations("envoy"),
+				Metadata:  metadata("envoy-binary"),
+			},
+		},
+		{
+			logicalFixture: "envoy/1.40.0/linux-amd64",
+			expected: pkg.Package{
+				Name:      "envoy",
+				Version:   "1.40.0",
+				Type:      "binary",
+				PURL:      "pkg:generic/envoy@1.40.0",
+				Locations: locations("envoy"),
+				Metadata:  metadata("envoy-binary"),
+			},
+		},
+		{
+			logicalFixture: "envoy/1.37.1/linux-amd64",
+			expected: pkg.Package{
+				Name:      "envoy",
+				Version:   "1.37.1",
+				Type:      "binary",
+				PURL:      "pkg:generic/envoy@1.37.1",
+				Locations: locations("envoy"),
+				Metadata:  metadata("envoy-binary"),
+			},
+		},
 		{
 			logicalFixture: "envoy/1.36.4/linux-amd64",
 			expected: pkg.Package{

syft/pkg/cataloger/binary/classifiers.go

@@ -1135,9 +1135,12 @@ func DefaultClassifiers() []binutils.Classifier {
 			FileGlob: "**/envoy",
 			EvidenceMatcher: binutils.MatchAny(
 				// 1.3x [NUL]1.36.4[NUL]...envoy_reloadable_features
+				// 1.4x [NUL]1.40.1[NUL]...envoy_reloadable_features
 				// 1.34.5 [NUL]1.34.5[NUL]...envoy.reloadable_features
-				m.FileContentsVersionMatcher(`(?s)\x00(?P<version>1\.3[0-9]\.[0-9]+(-dev)?)\x00.{0,1000}envoy_reloadable_features`),
+				m.FileContentsVersionMatcher(`(?s)\x00(?P<version>1\.[34][0-9]\.[0-9]+(-dev)?)\x00.{0,1000}envoy_reloadable_features`),
 				m.FileContentsVersionMatcher(`(?s)\x00(?P<version>1\.34\.5)\x00.{0,200}envoy\.reloadable_features`),
+				// 1.37.1 DeltaDiscoveryResponse.removed_resources[NUL]1.37.1[NUL]the default now-
+				m.FileContentsVersionMatcher(`(?s)DeltaDiscoveryResponse\.removed_resources\x00(?P<version>1\.[34][0-9]\.[0-9]+(-dev)?)\x00`),
 				// 1.2x envoy_quic_...[NUL]1.28.7[NUL]
 				m.FileContentsVersionMatcher(`(?s)envoy_quic_.{0,1000}\x00(?P<version>1\.2[0-9]\.[0-9]+(-dev)?)\x00`),
 				// 1.2x [NUL]1.20.7[NUL]Unable to

syft/pkg/cataloger/binary/testdata/config.yaml

@@ -1579,6 +1579,27 @@ from-images:
     paths:
       - /usr/lib/x86_64-linux-gnu/libkrb5.so.26.0.0
 
+  - version: 1.40.1
+    images:
+      - ref: envoyproxy/envoy:v1.40.1@sha256:713bb146f1a7c97ebc70e13d259f77ff36f2c5d00f3145677816af5af9bd1530
+        platform: linux/amd64
+    paths:
+      - /usr/local/bin/envoy
+
+  - version: 1.40.0
+    images:
+      - ref: envoyproxy/envoy:v1.40.0@sha256:459f2a6404c340fe6afccd69d85527012d47f3c036765493e6f8f3113fa384de
+        platform: linux/amd64
+    paths:
+      - /usr/local/bin/envoy
+
+  - version: 1.37.1
+    images:
+      - ref: envoyproxy/envoy:v1.37.1@sha256:29496a88fba9c4c9cdef4afe8fec70f536c5ba111b1c2bddbc5436b091ceca33
+        platform: linux/amd64
+    paths:
+      - /usr/local/bin/envoy
+
   - version: 1.36.4
     images:
       - ref: envoyproxy/envoy:v1.36.4@sha256:ae31562b8cede20913a2d3d6a4f44c8479a50551e033cb8ef7bb8e38cec4b573