feat: report unknowns in sbom (#2998)

Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>

test/cli/test-fixtures/image-unknowns/Dockerfile

@@ -0,0 +1,3 @@
+FROM alpine@sha256:c5c5fda71656f28e49ac9c5416b3643eaa6a108a8093151d6d1afc9463be8e33
+RUN rm -rf /lib/apk/db/installed
+COPY . /home/files

test/cli/test-fixtures/image-unknowns/executable-script

@@ -0,0 +1,2 @@
+#!/bin/sh
+echo "hello"

test/cli/test-fixtures/image-unknowns/package-lock.json

@@ -0,0 +1,3 @@
+invalid [{
+
+}]