fix: hold archive chains to the same bounds when scanning and decoding

Decoding SPDX, CycloneDX and syft-json rebuilt nested archive chains from whatever the document said, with no checks on entry names, depth or length. A small crafted document could forge archive boundaries or cost memory quadratic in its size (a 3 MB SPDX allocated ~14 GB).

- decoders now hold names to the scan's `EntryName` rules, and chains to `MaxDepth` (16) and PATH_MAX in length
- a file within a refused chain is dropped, rather than moved to a top-level path or merged into its outer archive
- the scan holds itself to the same bounds, so its SBOMs always decode back: a configured `nested-archive-max-depth` past 16 stops at 16, and an entry whose chain would be too long is skipped and the archive reported as truncated

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

syft/format/common/spdxhelpers/to_syft_model_test.go

@@ -2,6 +2,7 @@ package spdxhelpers
 
 import (
 	"reflect"
+	"strings"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
@@ -12,6 +13,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/anchore/packageurl-go"
+	"github.com/anchore/syft/internal/archive"
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
@@ -795,3 +797,24 @@ func Test_skipsPackagesWithGeneratedFromRelationship(t *testing.T) {
 	assert.NotNil(t, s.Artifacts.Packages.Package("1"))
 	assert.Nil(t, s.Artifacts.Packages.Package("1-src"))
 }
+
+func Test_nestedFiles_longChainIsCapped(t *testing.T) {
+	// a document can claim any chain; it decodes no deeper than a scan goes, without recursing per level, and
+	// what is past that is dropped
+	n := newNestedFiles[int]()
+	const length = 100_000
+	for i := range length {
+		n.own[i] = file.NewCoordinates("/a.jar", "")
+		if i > 0 {
+			n.container[i] = i - 1
+		}
+	}
+
+	for i := length - 1; i >= 0; i-- {
+		c, ok := n.coordinates(i)
+		assert.Equal(t, i <= archive.MaxDepth, ok, "%d", i)
+		if ok {
+			assert.Equal(t, "/a.jar"+strings.Repeat("!/a.jar", i), c.FullNestedPath())
+		}
+	}
+}