Less expensive deriveID for file source

**What would you like to be added**:
A less expensive deriveID function for file source

**Why is this needed**:
We discussed on the OSS community meeting on 22nd May that the file source deriveID function is a little peculiar in that it tries to SHA256 hash the entire contents of the file being scanned.

This gets expensive for users doing many file source scans.

We discussed on the call whether hashing the file contents is necessary, or whether we could avoid hashing file contents and just always hash the file (this is in fact the fallback if attempting to open the file errors). In addition there were discussions around using a more lightweight hash function to improve performance.

The Anchore team asked that I raise an issue here so that it could be discussed further.

**Additional context**:

Start by locating the file source deriveID function and reviewing its current whole-file SHA256 behavior and file-open fallback. The issue does not identify files or tests, and the intended identity and hashing approach still need agreement from the earlier OSS discussion before implementation can be considered complete.

Written by the indexing model from the issue text.