test(debian): bound the bomb fixture by ratio, not a fixed 1MB (#5350)

go1.27's compress/flate encodes 512MB of zeros to ~1MB (1052690 bytes) where go1.26 gives ~510KB, so the fixture sanity check tripped on newer toolchains before the bound was ever exercised. The decompression bound itself is fine (bounded read allocates ~300KB on both).

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

syft/pkg/cataloger/debian/parse_deb_archive_test.go

@@ -375,7 +375,7 @@ func Test_processDataTar_capsCopyrightFiles(t *testing.T) {
 func Test_decompressionStream_failsEarlyInsteadOfBuffering(t *testing.T) {
 	const expanded = 512 * intFile.MB
 
-	// a few KB of input expanding to 512MB, so heap is what separates a streaming bound from a
+	// well under 1% of input expanding to 512MB, so heap is what separates a streaming bound from a
 	// bound checked after the read completes
 	var gz bytes.Buffer
 	gw := gzip.NewWriter(&gz)
@@ -386,7 +386,9 @@ func Test_decompressionStream_failsEarlyInsteadOfBuffering(t *testing.T) {
 		remaining -= int64(n)
 	}
 	require.NoError(t, gw.Close())
-	require.Less(t, gz.Len(), 1024*1024, "compressed payload should be tiny relative to what it expands to")
+	// a ratio rather than a fixed size: deflate output for zeros is toolchain dependent (about 510KB on
+	// go1.26, about 1MB on go1.27), and only the ratio matters to the test
+	require.Less(t, gz.Len(), expanded/100, "compressed payload should be tiny relative to what it expands to")
 
 	// both arms use io.ReadAll on purpose. The stream itself never holds much whatever the cap says,
 	// so copying to io.Discard measures nothing; what the cap actually protects is a consumer that