Scan Go binaries in container images and improve debian/ubuntu support

I scan `docker://ghcr.io/nvidia/k8s-device-plugin:a044adb8-ubuntu22.04` as a docker_image and I have these issues:
- [ ] pkg:deb/debian is reported and furthermore with an unknown license. This comes from `db406658b54593a161c3de8c38f321420ed569ae94d7e16b1a6b7ce4d46bfba0/usr/share/doc/ca-certificates/examples/ca-certificates-local/debian/copyright` which seem to be an example, not really installed debian package. We should not pick copyright files at any depth in this case. The only correct file here is db406658b54593a161c3de8c38f321420ed569ae94d7e16b1a6b7ce4d46bfba0/usr/share/doc/ca-certificates/copyright for pkg:deb/ubuntu/ca-certificates@20230311ubuntu0.22.04.1?arch=all
- [ ] Some files like 931b7ff0cb6f494b27d31a4cbec3efe62ac54676add9c7469560302f1541ecaf/usr/bin/bash are not in a package bu `pkg:deb/ubuntu/bash@5.1-6ubuntu1.1?arch=amd64` is present alright
- [ ] There are some sort issues https://github.com/nexB/scancode.io/issues/1340
- [ ] Files like e2a9df91151cc4bf35761ec141555f9ebb8efb88e623b5e400e30f502c55034c/usr/bin/nvidia-device-plugin are binaries built from Go and we can extract a lot of origin details from them (and then enrich that with a PurlDB lookup). go-inspector does wonders here. See attached
[nvidia-device-plugin.yml.txt](https://github.com/user-attachments/files/16366083/nvidia-device-plugin.yml.txt)