fix: link nested java packages to their enclosing jar when nested cataloging is on

the legacy recursion links a nested jar to the jar that holds it: a `DEPENDENCY_OF` edge from inner to outer, and `JavaArchive.Parent` on the inner package. Inside an extracted archive java called `parse(ctx, nil)`, so both went away as soon as the feature was on. What replaced them was `file CONTAINS package`, which SPDX and CycloneDX drop, so those formats lost all war-to-jar structure.

- `archive.Traversal` gains `Parent` and `Packages` (the packages found describing that archive, filled in by the task after its sub-pipeline runs)
- java picks the enclosing jar's main package from the parent traversal (the one whose virtual path is the archive's own; pom-derived aux packages carry a suffixed one) and passes it to `parse`, then sets `Parent` the same way the legacy path does

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

internal/archive/traversal.go

@@ -5,6 +5,7 @@ import (
 	"strings"
 
 	"github.com/anchore/syft/syft/file"
+	"github.com/anchore/syft/syft/pkg"
 )
 
 // Traversal describes the archive whose contents a cataloger is running against. The archive
@@ -20,6 +21,14 @@ type Traversal struct {
 	// Digests are of the archive file itself, taken during extraction; a cataloger running inside the
 	// archive cannot compute them since the archive is not inside itself.
 	Digests []file.Digest
+
+	// Parent is the traversal of the archive this one is nested in, nil for an archive at the scan root.
+	Parent *Traversal
+
+	// Packages are those the catalogers found describing this archive (located at it), filled in once
+	// they have run. Catalogers inside a nested archive read them through Parent, as java does to link a
+	// nested jar to the jar that holds it.
+	Packages []pkg.Package
 }
 
 // ContentsArchivePath is the ArchivePath every file inside the archive carries: the chain to it, built