feat: add Debian archive (.deb) file cataloger (#3704)

* feat: add Debian archive (.deb) file cataloger

Add a cataloger that parses Debian package (.deb) archive files directly,
allowing Syft to discover packages from .deb files without requiring
them to be installed on the system. This implements issue #3315.

Key features:
- Parse .deb AR archives to extract package metadata
- Support for gzip, xz, and zstd compressed control files
- Extract package metadata from control files
- Process file information from md5sums files
- Mark configuration files from conffiles entries
- Handle trailing slashes in archive member names

Signed-off-by: Alan Pope <alan.pope@anchore.com>

* chore: run go mod tidy to fix failing workflow

Signed-off-by: Alan Pope <alan.pope@anchore.com>

* add license processing to dpkg archive cataloger + add tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update json schema with dpkg archive type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alan Pope <alan.pope@anchore.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>

syft/pkg/url.go

@@ -39,7 +39,7 @@ func PURLQualifiers(vars map[string]string, release *linux.Release) (q packageur
 		})
 	}
 
-	distroQualifiers := []string{}
+	var distroQualifiers []string
 
 	if release == nil {
 		return q
@@ -55,10 +55,12 @@ func PURLQualifiers(vars map[string]string, release *linux.Release) (q packageur
 		distroQualifiers = append(distroQualifiers, release.BuildID)
 	}
 
-	q = append(q, packageurl.Qualifier{
-		Key:   PURLQualifierDistro,
-		Value: strings.Join(distroQualifiers, "-"),
-	})
+	if len(distroQualifiers) > 0 {
+		q = append(q, packageurl.Qualifier{
+			Key:   PURLQualifierDistro,
+			Value: strings.Join(distroQualifiers, "-"),
+		})
+	}
 
 	return q
 }