Capture Alpine repository lists and world dependencies

It would be great if Syft captured some global information from apk while analyzing Alpine images/systems in order to provide a fuller picture of apk-based software installations.

And specifically, if Syft's output included apk's **world dependencies** and **repository lists**, this would allow users to create apko configurations from previously generated SBOMs. This apko feature idea is tracked in https://github.com/chainguard-dev/apko/issues/167.

Here's a look at the raw sources of this information in `alpine:3.15`:

```console
$ cat /etc/apk/world
alpine-baselayout
alpine-keys
apk-tools
busybox
libc-utils
$ cat /etc/apk/repositories
https://dl-cdn.alpinelinux.org/alpine/v3.15/main
https://dl-cdn.alpinelinux.org/alpine/v3.15/community
```

Questions for consideration:

1. Should additional apk information be captured, too? (e.g. from `/etc/apk/keys`)
2. What's the best way to represent this information in Syft's various output formats? (specifically, in CycloneDX, SPDX, and Syft JSON)
3. Should we consider opening additional issues in Syft to capture this kind of information for other distros (e.g. from `/etc/dpkg/...`)?

cc: @kaniini — let me know if I missed anything important!

Start by reviewing Syft's handling of Alpine images and the raw sources shown in /etc/apk/world and /etc/apk/repositories. Then examine how Syft represents data in CycloneDX, SPDX, and Syft JSON, and resolve whether /etc/apk/keys or analogous information for other distributions belongs in scope. Done means the agreed apk information is captured and represented consistently in the selected output formats.

Written by the indexing model from the issue text.