fix: return empty string if dereferncing pom var fails (#2797)

Previously, Syft would attempt to dereference pom variables, but if it
detected a cycle or failed to get back to a non-variable value, it would
return the last variable. Instead, return an empty string. Otherwise,
certain jars will have versions like "${project.version}" in the SBOM,
which is not helpful.

Signed-off-by: Will Murphy <will.murphy@anchore.com>

syft/pkg/cataloger/java/parse_pom_xml.go

@@ -236,7 +236,11 @@ func resolveProperty(pom gopom.Project, property *string, propertyName string) s
 	seenBeforePropertyNames := map[string]struct{}{
 		propertyName: {},
 	}
-	return recursiveResolveProperty(pom, propertyCase, seenBeforePropertyNames)
+	result := recursiveResolveProperty(pom, propertyCase, seenBeforePropertyNames)
+	if propertyMatcher.MatchString(result) {
+		return "" // dereferencing variable failed; fall back to empty string
+	}
+	return result
 }
 
 //nolint:gocognit