Introduce supplemental database information

**What would you like to be added**:
There is information Syft cannot ascertain from a static analysis of a filesystem, things like: dependency graph, many binaries, Java jars without Maven information, etc.. If Syft had a database which contained additional information like hashes for files with name and version information, other information like CPE naming, or license information; Syft could be able to more accurately identify software components.

**Why is this needed**:
To as accurately as possible identify all software components.

Start by reviewing Syft's current filesystem-analysis and component-identification flow, then determine where supplemental database data would integrate. Define the database contents and lookup behavior for hashes, name and version information, CPE naming, and license information, and document concrete acceptance criteria for more accurate component identification.

Written by the indexing model from the issue text.