Handle GOEXPERIMENTs in go version (#2893)

* Handle GOEXPERIMENTs in go version

Signed-off-by: Jon Johnson <jon.johnson@chainguard.dev>

* bump JSON schema

Signed-off-by: Will Murphy <will.murphy@anchore.com>

---------

Signed-off-by: Jon Johnson <jon.johnson@chainguard.dev>
Signed-off-by: Will Murphy <will.murphy@anchore.com>
Co-authored-by: Will Murphy <will.murphy@anchore.com>

syft/pkg/cataloger/golang/parse_go_binary.go

@@ -91,14 +91,17 @@ func (c *goBinaryCataloger) buildGoPkgInfo(resolver file.Resolver, location file
 		if dep == nil {
 			continue
 		}
+
+		gover, experiments := getExperimentsFromVersion(mod.GoVersion)
 		p := c.newGoBinaryPackage(
 			resolver,
 			dep,
 			mod.Main.Path,
-			mod.GoVersion,
+			gover,
 			arch,
 			nil,
 			mod.cryptoSettings,
+			experiments,
 			location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 		)
 		if pkg.IsValid(&p) {
@@ -118,14 +121,16 @@ func (c *goBinaryCataloger) buildGoPkgInfo(resolver file.Resolver, location file
 
 func (c *goBinaryCataloger) makeGoMainPackage(resolver file.Resolver, mod *extendedBuildInfo, arch string, location file.Location, reader io.ReadSeekCloser) pkg.Package {
 	gbs := getBuildSettings(mod.Settings)
+	gover, experiments := getExperimentsFromVersion(mod.GoVersion)
 	main := c.newGoBinaryPackage(
 		resolver,
 		&mod.Main,
 		mod.Main.Path,
-		mod.GoVersion,
+		gover,
 		arch,
 		gbs,
 		mod.cryptoSettings,
+		experiments,
 		location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
 	)
 
@@ -316,6 +321,23 @@ func getBuildSettings(settings []debug.BuildSetting) pkg.KeyValues {
 	return m
 }
 
+func getExperimentsFromVersion(version string) (string, []string) {
+	// See: https://github.com/anchore/grype/issues/1851
+	var experiments []string
+	version, rest, ok := strings.Cut(version, " ")
+	if ok {
+		// Assume they may add more non-version chunks in the future, so only look for "X:".
+		for _, chunk := range strings.Split(rest, " ") {
+			if strings.HasPrefix(rest, "X:") {
+				csv := strings.TrimPrefix(chunk, "X:")
+				experiments = append(experiments, strings.Split(csv, ",")...)
+			}
+		}
+	}
+
+	return version, experiments
+}
+
 func createMainModuleFromPath(path string) (mod debug.Module) {
 	mod.Path = path
 	mod.Version = devel