fix: recover from panics while extracting an archive

sub-pipeline catalogers were already run under `runTaskSafely`, but extraction wasn't: the zip, tar and compressor decoders run on untrusted bytes, and a panic in one unwound the whole walk and failed `CreateSBOM` with "failed to run tasks".

- `processArchive` recovers and returns the panic (with its stack) as an error at the archive's coordinates, so it becomes an unknown and the sibling archives are still cataloged
- `Extract` now defers `Cleanup` on failure instead of calling it on each error path, so a panic no longer leaks the limiter charge or the spill file

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

internal/archive/extract.go

@@ -28,9 +28,16 @@ func Extract(ctx context.Context, r io.Reader, fileSystemID, archivePath string,
 	charge := limiter.charge()
 	resolver := newResolver(ctx, fileSystemID, archivePath, charge)
 
+	// deferred so that a panic in a decoder still gives back the charge and removes any spill file
+	succeeded := false
+	defer func() {
+		if !succeeded {
+			resolver.Cleanup()
+		}
+	}()
+
 	content, release, err := resolver.acquire(r)
 	if err != nil {
-		resolver.Cleanup()
 		return nil, err
 	}
 	// the archive's own bytes are needed only until they are extracted and digested
@@ -38,15 +45,14 @@ func Extract(ctx context.Context, r io.Reader, fileSystemID, archivePath string,
 
 	format := identifyFormat(ctx, archiveFileName(archivePath), content)
 	if format == nil {
-		resolver.Cleanup()
 		return nil, nil
 	}
 
 	if err := resolver.extract(ctx, format, content, exclusions); err != nil {
-		resolver.Cleanup()
 		return nil, fmt.Errorf("unable to extract archive %q: %w", archivePath, err)
 	}
 	resolver.Digests = digestsOf(ctx, content, archivePath)
+	succeeded = true
 	return resolver, nil
 }