Add package-to-file location evidence relationships (#1698)

* add evident-by relationship

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* wire up evident-by relationship geneation

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* handle evident-by relationship in spdx formats

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix decoding file info for syft json format

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* bump json schema to incorporate file size attribute

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* refactor to create relationships for primary evidence only

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* fix linting

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* remove unused 7.0.2 json schema

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

---------

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

syft/artifact/relationship.go

@@ -7,6 +7,12 @@ const (
 	// has been completed.
 	OwnershipByFileOverlapRelationship RelationshipType = "ownership-by-file-overlap"
 
+	// EvidentByRelationship is a package-to-file relationship indicating the that existence of this package is evident
+	// by the contents of a file. This does not necessarily mean that the package is contained within that file
+	// or that it is described by it (either or both may be true). This does NOT map to an existing specific SPDX
+	// relationship. Instead, this should be mapped to OTHER and the comment field be updated to show EVIDENT_BY.
+	EvidentByRelationship RelationshipType = "evident-by"
+
 	// ContainsRelationship (supports any-to-any linkages) is a proxy for the SPDX 2.2 CONTAINS relationship.
 	ContainsRelationship RelationshipType = "contains"