feat: Record where CPEs come from (#2552)

Syft can get CPEs from several source, including generating them based on
package data, finding them in the NVD CPE dictionary, or finding them declared
in a manifest or existing SBOM. Record where Syft got CPEs so that consumers of
SBOMs can reason about how trustworthy they are.

Signed-off-by: Will Murphy <will.murphy@anchore.com>

syft/format/syftjson/model/package.go

@@ -32,10 +32,17 @@ type PackageBasicData struct {
 	Locations []file.Location `json:"locations"`
 	Licenses  licenses        `json:"licenses"`
 	Language  pkg.Language    `json:"language"`
-	CPEs      []string        `json:"cpes"`
+	CPEs      cpes            `json:"cpes"`
 	PURL      string          `json:"purl"`
 }
 
+type cpes []CPE
+
+type CPE struct {
+	Value  string `json:"cpe"`
+	Source string `json:"source,omitempty"`
+}
+
 type licenses []License
 
 type License struct {
@@ -74,6 +81,29 @@ func (f *licenses) UnmarshalJSON(b []byte) error {
 	return nil
 }
 
+func sourcedCPESfromSimpleCPEs(simpleCPEs []string) []CPE {
+	var result []CPE
+	for _, s := range simpleCPEs {
+		result = append(result, CPE{
+			Value: s,
+		})
+	}
+	return result
+}
+
+func (c *cpes) UnmarshalJSON(b []byte) error {
+	var cs []CPE
+	if err := json.Unmarshal(b, &cs); err != nil {
+		var simpleCPEs []string
+		if err := json.Unmarshal(b, &simpleCPEs); err != nil {
+			return fmt.Errorf("unable to unmarshal cpes: %w", err)
+		}
+		cs = sourcedCPESfromSimpleCPEs(simpleCPEs)
+	}
+	*c = cs
+	return nil
+}
+
 // PackageCustomData contains ambiguous values (type-wise) from pkg.Package.
 type PackageCustomData struct {
 	MetadataType string `json:"metadataType,omitempty"`