Document additional json schema fields (#4356)

* add documentation to key fields

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* regenerate json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

syft/pkg/alpm.go

@@ -58,6 +58,7 @@ type AlpmDBEntry struct {
 	Depends []string `mapstructure:"depends" json:"depends,omitempty"`
 }
 
+// AlpmFileRecord represents a single file entry within an Arch Linux package with its associated metadata tracked by pacman.
 type AlpmFileRecord struct {
 	// Path is the file path relative to the filesystem root
 	Path string `mapstruture:"path" json:"path,omitempty"`

syft/pkg/microsoft.go

@@ -1,10 +1,7 @@
 package pkg
 
-// MicrosoftKbPatch is slightly odd in how it is expected to map onto data.
-// This is critical to grasp because there is no MSRC cataloger. The `ProductID`
-// field is expected to be the MSRC Product ID, for example:
-// "Windows 10 Version 1703 for 32-bit Systems".
-// `Kb` is expected to be the actual KB number, for example "5001028"
+// MicrosoftKbPatch represents a Windows Knowledge Base patch identifier associated with a specific Microsoft product from the MSRC (Microsoft Security Response Center).
+// This type captures both the product being patched and the KB article number for the update.
 type MicrosoftKbPatch struct {
 	// ProductID is MSRC Product ID (e.g. "Windows 10 Version 1703 for 32-bit Systems")
 	ProductID string `toml:"product_id" json:"product_id"`

syft/pkg/npm.go

@@ -48,6 +48,7 @@ type YarnLockEntry struct {
 	Dependencies map[string]string `mapstructure:"dependencies" json:"dependencies"`
 }
 
+// PnpmLockResolution contains package resolution metadata from pnpm lockfiles, including the integrity hash used for verification.
 type PnpmLockResolution struct {
 	// Integrity is Subresource Integrity hash for verification (SRI format)
 	Integrity string `mapstructure:"integrity" json:"integrity"`