fix: keep panic stacks out of archive unknowns

A recovered panic while cataloging an archive became an unknown whose reason carried the full
goroutine stack, so a crafted archive that panicked a decoder put kilobytes of stack and build paths
into the published SBOM.

- the reason is now just `panic while cataloging archive: <value>`
- the stack is logged at debug, matching `runSubTaskSafely`

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

internal/task/archive_tasks.go

@@ -181,7 +181,9 @@ func (c *archiveCataloger) processArchive(ctx context.Context, parentResolver fi
 	// the decoders run on untrusted bytes; a panic in one costs this archive, not the scan
 	defer func() {
 		if r := recover(); r != nil {
-			err = fmt.Errorf("panic while cataloging archive: %v at:\n%s", r, debug.Stack())
+			// the stack goes to the log, not the reason: the reason lands in the published SBOM's unknowns
+			log.WithFields("path", candidate.location.FullNestedPath()).Debugf("archive cataloging panic stack:\n%s", debug.Stack())
+			err = fmt.Errorf("panic while cataloging archive: %v", r)
 		}
 	}()
 

internal/task/archive_tasks_test.go

@@ -98,7 +98,7 @@ func Test_archiveCataloger_aPanicCostsOnlyThatArchive(t *testing.T) {
 	require.NoError(t, remaining)
 	require.Len(t, coordErrs, 1)
 	assert.Equal(t, "/bad.zip", coordErrs[0].Coordinates.RealPath)
-	assert.ErrorContains(t, coordErrs[0].Reason, "panic while cataloging archive: decoder blew up")
+	assert.EqualError(t, coordErrs[0].Reason, "panic while cataloging archive: decoder blew up", "no stack trace in the SBOM-bound reason")
 	assert.Equal(t, []string{"/good.zip"}, seen, "the sibling is still cataloged")
 }