Enhance the CPE mapping index to include distro package to CPE mapping from release-monitoring.org

**What would you like to be added**:
Enhance the existing CPE mapping index generator at https://github.com/anchore/syft/tree/main/syft/pkg/cataloger/internal/cpegenerate/dictionary/index-generator to pull in the existing distro package to CPE mappings that exist at https://release-monitoring.org.

**Why is this needed**:

I am working on creating a more normalised and comprehensive dataset across several sources which we would eventually use here, but that will take quite a bit more time to get to a useable state and I think doing this now with the release-monitoring.org data would fill a gap and make immediate use of a lot of the mapping work I and others have done there.

In particular, generating accurate CPEs is very important to Alpine Linux and various similar derivatives because of the way vulnerability matching works (upstream by CPE with fixes from secdb filtered afterwards). You don't get comprehensive vulnerability results with only the secdb entries (especially on no longer supported distro versions), and if we have the wrong CPE for the package in the first place it will result in many false negatives.

**Additional context**:
Related to https://github.com/anchore/grype/issues/210

Also, we do plan to start pivoting as much of the vulnerability db data as possible in grype away from CPE, so for instance we could add the correct alpine package mappings to CPE in grype db itself, with CPE as just an alias mapping to many packages, but that is probably a larger undertaking though more valuable in the long-term because grype dbs update daily wheras this generated index embedded in syft is static until the next release

Start in syft/pkg/cataloger/internal/cpegenerate/dictionary/index-generator and inspect how the existing CPE mapping index is generated. Review the distro package-to-CPE mappings available at release-monitoring.org and the related grype issue to understand the expected source and mapping scope. Done means the generated index includes these mappings with accurate CPE associations.

Written by the indexing model from the issue text.