fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type

[DmitriyLewen]

Description

We don't save FilePath for app with aggregatedTypes.
That is why we overwrite apps with same types.
See more in #7851

This PR adds filepath (path to the SBOM file) for Apps got from SBOM analyzer.
This helps with overwriting when merging layers.

Example:

FROM alpine

COPY ./api/report-api.spdx.json /api/report-api.spdx.json

COPY ./core/report-core.spdx.json /core/report-core.spdx.json

before:

➜ trivy -q image test:7846 -f json --list-all-pkgs --pkg-types library --cache-backend memory | grep -E '"ID"|"FilePath"'
          "ID": "org.apache.logging.log4j:log4j-core:2.24.1",
          "FilePath": "log4j-core-2.24.1.jar"

after:

➜ ./trivy -q image test:7846 -f json --list-all-pkgs --pkg-types library --cache-backend memory | grep -E '"ID"|"FilePath"'
          "ID": "org.apache.logging.log4j:log4j-api:2.24.1",
          "FilePath": "log4j-api-2.24.1.jar"
          "ID": "org.apache.logging.log4j:log4j-core:2.24.1",
          "FilePath": "log4j-core-2.24.1.jar"

Related issues

• Close bug(sbom): Trivy overwrites Applications when multiple sbom files contain aggregated language type #7851

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

@knqyf263
Looks like i found workaround/solution for #7851.
Take a look, when you have time.

[DmitriyLewen]

@aqua-bot backport release/v0.58

[aqua-bot]

Backport PR created: #8124