Use SBOM descriptor version (#1011)

* Use SBOM descriptor version

Signed-off-by: Jonas Xavier <jonasx@anchore.com>

* Update tests

Signed-off-by: Jonas Xavier <jonasx@anchore.com>

* CycloneDX extract tools metadata in decoding stage

Signed-off-by: Jonas Xavier <jonasx@anchore.com>

* add descriptor to spdx tag-value test

Signed-off-by: Jonas Xavier <jonasx@anchore.com>

* remove comment

Signed-off-by: Jonas Xavier <jonasx@anchore.com>

internal/formats/github/encoder.go

@@ -10,7 +10,6 @@ import (
 	"github.com/anchore/packageurl-go"
 	"github.com/anchore/syft/internal"
 	"github.com/anchore/syft/internal/log"
-	"github.com/anchore/syft/internal/version"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/sbom"
 	"github.com/anchore/syft/syft/source"
@@ -19,8 +18,8 @@ import (
 // toGithubModel converts the provided SBOM to a GitHub dependency model
 func toGithubModel(s *sbom.SBOM) DependencySnapshot {
 	scanTime := time.Now().Format(time.RFC3339) // TODO is there a record of this somewhere?
-	v := version.FromBuild().Version
-	if v == "[not provided]" {
+	v := s.Descriptor.Version
+	if v == "[not provided]" || v == "" {
 		v = "0.0.0-dev"
 	}
 	return DependencySnapshot{