Configuration files described in SPDX with DESCRIBED_BY relationships are imported as Syft packages

SPDX import should exclude more packages depending on the relationships found. As reported in #3662, we should probably filter out packages with `DESCRIBED_BY` relationships, which appears to be used in some SBOMs to describe configuration files rather than packages. Originally reported:

> One other weird situation in the Wolfi spdx files - it leads to discovery of many components that are named *.yaml, for example:
> git.yaml version d5b8192e47958e7c3f8173ef26701ae84a796f50
>
> Not sure what is going on here as git with the correct version of 2.48.1-r1 is also discovered.

_Originally posted by @ciscochaig in [#3662](https://github.com/anchore/syft/issues/3662#issuecomment-2722198659)_

Looking at the cause, this example is due to the following SBOM found in the image `cgr.dev/chainguard/curl:latest`, containing file `/var/lib/db/sbom/libbrotlicommon1-1.1.0-r5.spdx.json`:
```
{
"SPDXID": "SPDXRef-DOCUMENT",
"name": "apk-libbrotlicommon1-1.1.0-r5",
"spdxVersion": "SPDX-2.3",
"creationInfo": {
"created": "2025-05-28T13:35:48Z",
"creators": [
"Tool: melange (v0.26.1+dirty)",
"Organization: Chainguard, Inc"
],
"licenseListVersion": "3.22"
},
"dataLicense": "CC0-1.0",
"documentNamespace": "https://spdx.org/spdxdocs/chainguard/melange/0e9b37b4f85474079f54ceac8c78b8e8",
"documentDescribes": [
"SPDXRef-Package-libbrotlicommon1-1.1.0-r5"
],
"packages": [
{
"SPDXID": "SPDXRef-Package-libbrotlicommon1-1.1.0-r5",
"name": "libbrotlicommon1",
"versionInfo": "1.1.0-r5",
"filesAnalyzed": false,
"licenseConcluded": "NOASSERTION",
"licenseDeclared": "MIT",
"downloadLocation": "NOASSERTION",
"originator": "Organization: Wolfi",
"supplier": "Organization: Wolfi",
"copyrightText": "NOASSERTION",
"externalRefs": [
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceLocator": "pkg:apk/wolfi/libbrotlicommon1@1.1.0-r5?arch=x86_64",
"referenceType": "purl"
}
]
},
{
"SPDXID": "SPDXRef-Package-brotli.yaml-cfbfc5c7500721e9c6e95221587c5d6943cddda5",
"name": "brotli.yaml",
"versionInfo": "cfbfc5c7500721e9c6e95221587c5d6943cddda5",
"filesAnalyzed": false,
"licenseConcluded": "NOASSERTION",
"licenseDeclared": "NOASSERTION",
"downloadLocation": "NOASSERTION",
"originator": "Organization: Wolfi",
"supplier": "Organization: Wolfi",
"externalRefs": [
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceLocator": "pkg:github/wolfi-dev/os@cfbfc5c7500721e9c6e95221587c5d6943cddda5#brotli.yaml",
"referenceType": "purl"
}
]
},
{
"SPDXID": "SPDXRef-Package-github.com-google-brotli.git-v1.1.0-ed738e842d2fbdf2d6459e39267a633c4a9b2f5d-0",
"name": "brotli",
"versionInfo": "v1.1.0",
"filesAnalyzed": false,
"licenseConcluded": "NOASSERTION",
"licenseDeclared": "MIT",
"downloadLocation": "https://github.com/google/brotli/archive/ed738e842d2fbdf2d6459e39267a633c4a9b2f5d.tar.gz",
"originator": "Organization: Google",
"supplier": "Organization: Google",
"externalRefs": [
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceLocator": "pkg:github/google/brotli@v1.1.0",
"referenceType": "purl"
}
]
}
],
"relationships": [
{
"spdxElementId": "SPDXRef-Package-libbrotlicommon1-1.1.0-r5",
"relationshipType": "DESCRIBED_BY",
"relatedSpdxElement": "SPDXRef-Package-brotli.yaml-cfbfc5c7500721e9c6e95221587c5d6943cddda5"
},
{
"spdxElementId": "SPDXRef-Package-libbrotlicommon1-1.1.0-r5",
"relationshipType": "GENERATED_FROM",
"relatedSpdxElement": "SPDXRef-Package-github.com-google-brotli.git-v1.1.0-ed738e842d2fbdf2d6459e39267a633c4a9b2f5d-0"
}
]
}
```

No source file or test is named. Start at the SPDX importer and relationship handling using the sample document in the issue; done means packages linked through DESCRIBED_BY are excluded while the actual package and GENERATED_FROM dependency remain imported.

Written by the indexing model from the issue text.