Different results on Windows and macOS/Linux while scanning OCI images

**What happened**:

We run OCI image scans on different systems/os and observed a significant difference in the findings between Windows and Linux/macOS.

**What you expected to happen**:

We expect that the results of the scans are identical despite of the underlaying os.

**How to reproduce it (as minimally and precisely as possible)**:

Scan on macOS of a Bitnami legacy image ([mariadb:11.8.3-debian-12-r0](https://hub.docker.com/layers/bitnamilegacy/mariadb/11.8.3-debian-12-r0/images/sha256-1b9e6738404c9c1a1d5c54167ff2fce02b90e6fc260dd8a9b3cd355549cfe60f)) results in this report (shortened):

```shell
grype --sort-by epss docker:bitnamilegacy/mariadb:11.8.3-debian-12-r0@sha256:1b9e6738404c9c1a1d5c54167ff2fce02b90e6fc260dd8a9b3cd355549cfe60f
✔ Loaded image bitnamilegacy/mariadb:11.8.3-debian-12-r0@sha256:1b9e6738404c9c1a1d5c54167ff2fce02b90e6fc260dd8a9b3cd355549cfe60f
✔ Parsed image sha256:e0ad4c39fc9c5fd8ff03c48f91f24d96b9f1bd1f52310733c938c1975f899843
✔ Cataloged contents e0efcfa7a900366499ee60fdc64fc37d8f08c8ea1676791c417021ce67d8f270
├── ✔ Packages [113 packages]
├── ✔ Executables [860 executables]
├── ✔ File metadata [5,547 locations]
└── ✔ File digests [5,547 files]
✔ Scanned for vulnerabilities [134 vulnerability matches]
├── by severity: 2 critical, 23 high, 39 medium, 12 low, 55 negligible (3 unknown)
NAME INSTALLED FIXED IN TYPE VULNERABILITY SEVERITY EPSS RISK
login 1:4.13+dfsg1-1+deb12u1 (won't fix) deb CVE-2024-56433 Low 5.1% (89th) 1.7
passwd 1:4.13+dfsg1-1+deb12u1 (won't fix) deb CVE-2024-56433 Low 5.1% (89th) 1.7
libgnutls30 3.7.9-2+deb12u5 deb CVE-2011-3389 Negligible 4.1% (88th) 0.2
tar 1.34+dfsg-1.2+deb12u1 deb CVE-2005-2541 Negligible 1.8% (82nd) < 0.1
libc-bin 2.36-9+deb12u10 deb CVE-2018-20796 Negligible 1.7% (81st) < 0.1
libc6 2.36-9+deb12u10 deb CVE-2018-20796 Negligible 1.7% (81st) < 0.1
apt 2.6.1 deb CVE-2011-3374 Negligible 1.5% (80th) < 0.1
libapt-pkg6.0 2.6.1 deb CVE-2011-3374 Negligible 1.5% (80th) < 0.1
libperl5.36 5.36.0-7+deb12u2 5.36.0-7+deb12u3 deb CVE-2023-31484 High 1.2% (78th) 0.9
perl 5.36.0-7+deb12u2 5.36.0-7+deb12u3 deb CVE-2023-31484 High 1.2% (78th) 0.9
perl-base 5.36.0-7+deb12u2 5.36.0-7+deb12u3 deb CVE-2023-31484 High 1.2% (78th) 0.9
```

In contrast, on Windows we get this report (shortened):

```shell
grype --sort-by epss docker:bitnamilegacy/mariadb:11.8.3-debian-12-r0@sha256:1b9e6738404c9c1a1d5c54167ff2fce02b90e6fc260dd8a9b3cd355549cfe60f
✔ Loaded image bitnamilegacy/mariadb:11.8.3-debian-12-r0@sha256:1b9e6738404c9c1a1d5c54167ff2fce02b90e6fc260dd8a9b3cd355549cfe60f
✔ Parsed image sha256:e0ad4c39fc9c5fd8ff03c48f91f24d96b9f1bd1f52310733c938c1975f899843
✔ Cataloged contents 4f925e705f75bf2b1d944127e75f2d86776850fb8256082e9d3c8e5691ca7733
├── ✔ Packages [120 packages]
├── ✔ File metadata [405 locations]
├── ✔ Executables [860 executables]
└── ✔ File digests [405 files]
✔ Scanned for vulnerabilities [141 vulnerability matches]
├── by severity: 2 critical, 24 high, 40 medium, 13 low, 59 negligible (3 unknown)
NAME INSTALLED FIXED IN TYPE VULNERABILITY SEVERITY EPSS RISK
util-linux 2.38.1 2.39.4, 2.40.1 binary CVE-2024-28085 Low 11.9% (93rd) 3.8
login 1:4.13+dfsg1-1+deb12u1 (won't fix) deb CVE-2024-56433 Low 5.1% (89th) 1.7
passwd 1:4.13+dfsg1-1+deb12u1 (won't fix) deb CVE-2024-56433 Low 5.1% (89th) 1.7
libgnutls30 3.7.9-2+deb12u5 deb CVE-2011-3389 Negligible 4.1% (88th) 0.2
tar 1.34+dfsg-1.2+deb12u1 deb CVE-2005-2541 Negligible 1.8% (82nd) < 0.1
libc-bin 2.36-9+deb12u10 deb CVE-2018-20796 Negligible 1.7% (81st) < 0.1
libc6 2.36-9+deb12u10 deb CVE-2018-20796 Negligible 1.7% (81st) < 0.1
apt 2.6.1 deb CVE-2011-3374 Negligible 1.5% (80th) < 0.1
libapt-pkg6.0 2.6.1 deb CVE-2011-3374 Negligible 1.5% (80th) < 0.1
libperl5.36 5.36.0-7+deb12u2 5.36.0-7+deb12u3 deb CVE-2023-31484 High 1.2% (78th) 0.9
perl 5.36.0-7+deb12u2 5.36.0-7+deb12u3 deb CVE-2023-31484 High 1.2% (78th) 0.9
```

So we have a difference of **134 vulnerability matches on macOS** (with 2 critical, 23 high, 39 medium, 12 low, 55 negligible (3 unknown)) vs. **141 vulnerability matches on Windows** (with 2 critical, 24 high, 40 medium, 13 low, 59 negligible (3 unknown)).

As you can see, the Windows version reports `util-linux` which is not reported by the macOS version.

And please take a note on the difference of the _Cataloged contents_:

| Content| macOS | Windows |
| :------------ | :--- | :--- |
| Packages | 113 | 120 |
| Executables | 860 | 860 |
| File metadata | 5,547 | 405 |
| File digests | 5,547 | 405 |

**Anything else we need to know?**:

Tested this in a Linux VM on a AMD system, too, which gives same results as macOS.

If needed, I can provide a JSON or a debug output.

**Environment**:
- Output of `grype version`:
- macOS: grype 0.105.0
- Windows: grype 0.105.0
- OS:
- macOS 15.7.3 (ARM)
- Windows: Windows 11 Pro (10.0.26100)
- Vuln Database: On both systems `https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.3_2026-01-19T00:30:15Z_1768803534.tar.zst?checksum=sha256%3A9ef6ea8862fb4ab502bbc5cb5a1de505ec673ece93002b2d0b8748aeef6ae60e`

As the macOS runs on Apple Silicon (ARM), I used the digest to ensure the correct platform image.
On macOS, Rancher Desktop was used as the container engine, with VZ emulation and enabled Rosetta.