Catalog git repos natively

(writing on the behalf of @westonsteimel )

Today to scan a source repo you need to clone it first:
```
git clone ...
syft ./my-repo
```

It would be more ideal to specify a repo URL and let syft deal with cloning for me:

```
# access via git ssh
syft git@github.com:casey/just.git

# access with https
syft https://github.com/casey/just.git
```

_(we'd also have an additional explicit `git` scheme)_

When we catalog git repos we should also start capturing repo specific metadata, like commit sha, tag, dirty state, etc. This should be metadata on the SBOM source object with a new type. We should maybe even upgrade implicit `dir:` scans to `git:` scans when we detect git information.

No files, tests, or entry points are named. Start by tracing how syft currently handles directory inputs and source metadata, then identify the CLI path for accepting git SSH, HTTPS, and explicit git URLs. Done means remote repositories can be cataloged without a manual clone and the SBOM source records commit SHA, tag, and dirty state, including the proposed handling of implicit dir scans.

Written by the indexing model from the issue text.