fix(spdx): don't panic on a root file without a supplier or null entries (#5326)

The package supplier is optional in SPDX, but fileSource dereferenced it
without the nil check containerSource already has, so a valid SPDX 2.3
document whose described package has primaryPackagePurpose FILE and no
supplier crashed syft convert and grype sbom: input.

A JSON null in files, a package's files or externalRefs (or an SPDX 2.1
package the version converter cannot map) decodes to a nil pointer that
the conversion then dereferences. Drop nil entries once at the start of
ToSyftModel instead of guarding each loop.

Signed-off-by: Tony <tjagodka@gmail.com>

syft/format/common/spdxhelpers/to_syft_model.go

@@ -34,6 +34,8 @@ func ToSyftModel(doc *spdx.Document) (*sbom.SBOM, error) {
 		return nil, errors.New("cannot convert SPDX document to Syft model because document is nil")
 	}
 
+	removeNilElements(doc)
+
 	spdxIDMap := make(map[string]any)
 
 	s := &sbom.SBOM{
@@ -55,6 +57,28 @@ func ToSyftModel(doc *spdx.Document) (*sbom.SBOM, error) {
 	return s, nil
 }
 
+// removeNilElements drops null entries from the document's lists. A JSON null (or an element the SPDX version
+// converter cannot map) decodes to a nil pointer, and the rest of the conversion dereferences these elements.
+func removeNilElements(doc *spdx.Document) {
+	doc.Packages = withoutNil(doc.Packages)
+	for _, p := range doc.Packages {
+		p.Files = withoutNil(p.Files)
+		p.PackageExternalReferences = withoutNil(p.PackageExternalReferences)
+	}
+	doc.Files = withoutNil(doc.Files)
+	doc.Relationships = withoutNil(doc.Relationships)
+}
+
+func withoutNil[T any](items []*T) []*T {
+	var out []*T
+	for _, item := range items {
+		if item != nil {
+			out = append(out, item)
+		}
+	}
+	return out
+}
+
 func isDirectory(name string) bool {
 	if name == "." || name == ".." || strings.HasSuffix(name, "/") || !strings.Contains(path.Base(name), ".") {
 		return true
@@ -201,7 +225,7 @@ func fileSource(p *spdx.Package) source.Description {
 	}
 
 	supplier := ""
-	if p.PackageSupplier.Supplier != helpers.NOASSERTION {
+	if p.PackageSupplier != nil && p.PackageSupplier.Supplier != helpers.NOASSERTION {
 		supplier = p.PackageSupplier.Supplier
 	}