chore: centralize temp files and prefer streaming IO (#4668)

* chore: centralize temp files and prefer streaming IO

Catalogers that create temp files ad-hoc can easily forget cleanup,
leaking files on disk. Similarly, io.ReadAll is convenient but risks
OOM on large or malicious inputs.

Introduce internal/tmpdir to manage all cataloger temp storage under
a single root directory with automatic cleanup. Prefer streaming
parsers (bufio.Scanner, json/yaml.NewDecoder, io.LimitReader) over
buffering entire inputs into memory. Add ruleguard rules to enforce
both practices going forward.

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* chore: go back to old release parsing

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* simplify to limit reader in version check

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* chore: regex change postponed

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* simplify supplement release to limitreader

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

---------

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

internal/testutils/golden_files.go

@@ -31,7 +31,7 @@ func UpdateGoldenFileContents(t *testing.T, contents []byte) {
 
 	t.Log(dangerText("!!! UPDATING GOLDEN FILE !!!"), goldenFilePath)
 
-	err := os.WriteFile(goldenFilePath, contents, 0600)
+	err := os.WriteFile(goldenFilePath, contents, 0o600)
 	if err != nil {
 		t.Fatalf("could not update golden file (%s): %+v", goldenFilePath, err)
 	}
@@ -50,7 +50,9 @@ func GetGoldenFileContents(t *testing.T) []byte {
 	}
 	defer f.Close()
 
-	bytes, err := io.ReadAll(f)
+	// suppress lint prohibiting ReadAll since golden files are source files in Syft's repository
+	// and not user provided artifacts.
+	bytes, err := io.ReadAll(f) //nolint:gocritic // golden files are trusted source files, not user artifacts
 	if err != nil {
 		t.Fatalf("could not read file (%s): %+v", goldenPath, err)
 	}