fix: only look up owned-by-package files in the resolver's own frame

with `FilesOwnedByPackageSelection` the file catalogers take every package location in the SBOM and look it up by `RealPath` in the resolver they were given. Inside an archive, the java package's location is the archive itself *in its parent's frame* (`WEB-INF/lib/dep.jar`), so the sub-pipeline looked that path up inside `dep.jar`'s own resolver: a miss, or an unrelated same-named entry by coincidence. At the root, coordinates from inside archives were looked up against the scan root the same way.

`coordinatesForSelection` now keeps only coordinates whose `ArchivePath` matches the current frame (the traversal's `ContentsArchivePath()`, or blank at the root).

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

internal/archive/traversal.go

@@ -22,6 +22,15 @@ type Traversal struct {
 	Digests []file.Digest
 }
 
+// ContentsArchivePath is the ArchivePath every file inside the archive carries: the chain to it, built
+// from real paths. Outside any archive (a nil Traversal) it is blank, as for files at the scan root.
+func (t *Traversal) ContentsArchivePath() string {
+	if t == nil {
+		return ""
+	}
+	return VirtualPath(file.NewLocationFromCoordinates(t.Location.Coordinates))
+}
+
 // VirtualPath returns the colon-delimited chain of archives from the scan root to loc, ending in loc
 // itself: "app.war:WEB-INF/lib/dep.jar". Outside any archive it is the location's path unchanged. In an
 // entry name '%' is escaped as "%25" and then ':' as "%3A", so splitting on ':' recovers the archive