add file-based toolchain detection

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

schema/json/schema-latest.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "anchore.io/schema/syft/json/16.1.10/document",
+  "$id": "anchore.io/schema/syft/json/16.1.11/document",
   "$ref": "#/$defs/Document",
   "$defs": {
     "AlpmDbEntry": {
@@ -1398,6 +1398,13 @@
         "elfSecurityFeatures": {
           "$ref": "#/$defs/ELFSecurityFeatures",
           "description": "ELFSecurityFeatures contains ELF-specific security hardening information when Format is ELF."
+        },
+        "toolchains": {
+          "items": {
+            "$ref": "#/$defs/Toolchain"
+          },
+          "type": "array",
+          "description": "Toolchains captures information about the compiler, linker, runtime, or other toolchains used to build (or otherwise exist within) the executable."
         }
       },
       "type": "object",
@@ -4450,6 +4457,27 @@
       ],
       "description": "TerraformLockProviderEntry represents a single provider entry in a Terraform dependency lock file (.terraform.lock.hcl)."
     },
+    "Toolchain": {
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Name is the name of the toolchain (e.g., \"gcc\", \"clang\", \"rust\", \"lld\", \"GNU AS\", etc.)."
+        },
+        "version": {
+          "type": "string",
+          "description": "Version is the version of the toolchain."
+        },
+        "component": {
+          "type": "string",
+          "description": "Component indicates which part of the toolchain this represents (e.g., compiler, linker, assembler)."
+        }
+      },
+      "type": "object",
+      "required": [
+        "name",
+        "component"
+      ]
+    },
     "VcpkgManifest": {
       "properties": {
         "description": {