Mark package relations by file ownership (#329)

* add marking package relations by file ownership

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* correct json schema version; ensure fileOwners dont return dups; pin test pkg versions

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* extract package relationships into separate section

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* pull in client-go features for import of PackageRelationships

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* move unit test for ownership by files relationship further down

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

* rename relationship to "ownership-by-file-overlap"

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

syft/pkg/package.go

@@ -9,12 +9,9 @@ import (
 	"github.com/anchore/syft/syft/source"
 )
 
-// ID represents a unique value for each package added to a package catalog.
-type ID int64
-
 // Package represents an application or library that has been bundled into a distributable format.
 type Package struct {
-	id        ID                // uniquely identifies a package, set by the cataloger
+	ID        ID                // uniquely identifies a package, set by the cataloger
 	Name      string            // the package name
 	Version   string            // the version of the package
 	FoundBy   string            // the specific cataloger that discovered this package
@@ -29,11 +26,6 @@ type Package struct {
 	Metadata     interface{}  // additional data found while parsing the package source
 }
 
-// ID returns the package ID, which is unique relative to a package catalog.
-func (p Package) ID() ID {
-	return p.id
-}
-
 // Stringer to represent a package.
 func (p Package) String() string {
 	return fmt.Sprintf("Pkg(type=%s, name=%s, version=%s)", p.Type, p.Name, p.Version)