fix: build ArchivePath from real paths, not access paths

each `ArchivePath` segment came from `loc.Path()`, so it was the link path when an archive was reached through a symlink and the real path otherwise. That depended on how discovery happened to find the archive. The package location said `store/3f9a1c` while the files inside the same jar were recorded under `...:app/lib/json-simple-1.1.1.jar`, so a consumer couldn't join a package to its files by prefix.

The chain for extracted files is now built from `RealPath`. `Traversal.Location` still carries the access path, so java's name check and `VirtualPath` metadata behave the same as before. The field comment and schema now say every segment has links resolved.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

internal/archive/traversal.go

@@ -11,8 +11,10 @@ import (
 // cataloger task puts one on the context before running catalogers inside an archive, so a cataloger
 // such as java can describe the archive it is inside without owning the recursion.
 type Traversal struct {
-	// Location is the archive file's location within its parent filesystem. Its ArchivePath names the
-	// archives above it, so VirtualPath(Location) is the full chain from the scan root.
+	// Location is the archive file's location within its parent filesystem, including the access path
+	// it was reached by. Its ArchivePath names the archives above it, so VirtualPath(Location) is the
+	// full chain from the scan root as seen through that access path. The ArchivePath of the files
+	// inside it is built from the real path instead.
 	Location file.Location
 
 	// Digests are of the archive file itself, taken during extraction; a cataloger running inside the