Don't rescan already scanned resources (container layers? packages?)

This is related to #323 but could be extended to other resources

It would be good to reuse scans of stuff that has been already scanned.
This needs some discussion starting from granularity:
in case of containers it could be e.g. layers
for rootfs it could be on package level (hash from purl, scancode-toolkit version, and other metadata that might be needed) but this might be an issue when there would be a lot of packages to lookup from) general files would not be subject to such mechanism due to amount of them
I'm sure there is a lot more to think about regarding this but this is not a feature that we need quickly and I just wanted to open discussion regarding this and so it could be kept in mind during other changes