fix: Remove two Rust crate false positive CPE matches (#3962)

Rust crates opentelemetry and redis are being given CPEs that
match CVEs such as CVE-2023-45142 and CVE-2022-24735 respectively.
The vendor overrides added here prevent that.

Signed-off-by: John Vandenberg <jayvdb@gmail.com>

syft/pkg/cataloger/internal/cpegenerate/candidate_by_package_type.go

@@ -486,7 +486,6 @@ var defaultCandidateAdditions = buildCandidateLookup(
 			candidateKey{PkgName: "dnsmasq", Vendor: "dnsmasq"},
 			candidateAddition{AdditionalVendors: []string{"thekelleys"}},
 		},
-		//
 		// Binary packages
 		{
 			pkg.BinaryPkg,
@@ -630,7 +629,18 @@ var defaultCandidateRemovals = buildCandidateRemovalLookup(
 			candidateKey{PkgName: "grpc"},
 			candidateRemovals{ProductsToRemove: []string{"grpc"}},
 		},
-		// PHP Packages
+		// Rust packages
+		{
+			pkg.RustPkg,
+			candidateKey{PkgName: "opentelemetry"},
+			candidateRemovals{ProductsToRemove: []string{"opentelemetry"}},
+		},
+		{
+			pkg.RustPkg,
+			candidateKey{PkgName: "redis"},
+			candidateRemovals{VendorsToRemove: []string{"redis"}},
+		},
+		// PHP packages
 		{
 			pkg.PhpPearPkg,
 			candidateKey{PkgName: "redis"},