added macOS .app cataloger (#4490)

* added macOS .app cataloger, fixed #4010

Signed-off-by: Rez Moss <hi@rezmoss.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* added macOS .app cataloger, fixed #4010

Signed-off-by: Rez Moss <hi@rezmoss.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* added macOS .app cataloger, fixed #4010

Signed-off-by: Rez Moss <hi@rezmoss.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address review comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* bump schema to 16.1.7

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* address static analysis failures

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* migrate to testdata

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* expand fields and improve test coverage

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Rez Moss <hi@rezmoss.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>

syft/format/internal/spdxutil/helpers/originator_supplier_test.go

@@ -31,6 +31,7 @@ func Test_OriginatorSupplier(t *testing.T) {
 		pkg.GolangModuleEntry{},
 		pkg.GolangSourceEntry{},
 		pkg.HomebrewFormula{},
+		pkg.AppleAppBundleEntry{},
 		pkg.HackageStackYamlLockEntry{},
 		pkg.HackageStackYamlEntry{},
 		pkg.LinuxKernel{},

syft/format/internal/spdxutil/helpers/source_info.go

@@ -80,6 +80,8 @@ func SourceInfo(p pkg.Package) string {
 		answer = "acquired package info from found wordpress plugin PHP source files"
 	case pkg.HomebrewPkg:
 		answer = "acquired package info from Homebrew formula"
+	case pkg.AppleAppBundlePkg:
+		answer = "acquired package info from Apple application bundle Info.plist"
 	case pkg.TerraformPkg:
 		answer = "acquired package info from Terraform dependency lock file"
 	case pkg.ModelPkg:

syft/format/internal/spdxutil/helpers/source_info_test.go

@@ -343,6 +343,14 @@ func Test_SourceInfo(t *testing.T) {
 				"acquired package info from Homebrew formula",
 			},
 		},
+		{
+			input: pkg.Package{
+				Type: pkg.AppleAppBundlePkg,
+			},
+			expected: []string{
+				"acquired package info from Apple application bundle Info.plist",
+			},
+		},
 		{
 			input: pkg.Package{
 				Type: pkg.TerraformPkg,