[ECR] [request]: Support for busybox / scratch base image in Enhanced Vulnerability Scan - Inspector

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Which service(s) is this request for?**
ECR

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Inspector / ECR Enhanced Scanning can’t scan scratch images (or images based on it like **busybox**). Once pushing to ECR, you getting following output in AWS Console:
```
No scan findings
Scan status: UNSUPPORTED_IMAGE
```
Docker images based on busybox base-image are a quite common image. In our case we are not able to use the default [Prometheus image](https://github.com/prometheus/prometheus/blob/main/Dockerfile) (since we not able to scan this image before we deploy it to ECS). If you like to see the issue, just pull an image like quay.io/prometheus/busybox.

**Are you currently working around this issue?**
Currently no workaround known. In case it’s not getting fixed soon, we might have to move away from Inspector.

**Attachments**
When Inspector scans an image, there are two steps it takes:
(1) it generates a Software Bill of Material (SBOM) which is a manifest of the image's contents. For example, this lists the OS version and information about all of the pacakges installed in it.
(2) the SBOM is cross-referenced against a vulnerability dashboard to determine which vulnerabilties apply to the contents of SBOM.

The tool used by Inspector to generate SBOMs is [sbomgen](https://docs.aws.amazon.com/inspector/latest/user/sbom-generator.html). Since sbomgen is the first step of image scanning, if smbomgen is unable to scan busybox then this explains why Inspector as a whole cannot.

When we ran sbomgen on the busybox image, it failed with the error "unable to initialization sysinfo with non-linux container." This is peculiar, as busybox is a Linux-based image so this error does not make sense.

To understand why busybox isn't recognised as a Linux image, we took a look at it's [Dockerfile](https://github.com/docker-library/busybox/blob/09ee80aedec1d8c604f104e8bec41ed19274620a/latest-1/glibc/Dockerfile) and found that it's simply:
```
FROM scratch
ADD busybox.tar.xz /
CMD ["sh"]
```
The busybox.tar.xz is generated by a different [Dockerfile](https://github.com/docker-library/busybox/blob/09ee80aedec1d8c604f104e8bec41ed19274620a/latest-1/glibc/busybox.tar.xz). One interesting this we noticed is that this file doesn't include an /etc/os-release file. This file is conventionally used to identify that the OS is Linux and so we are suspicous that this could be the root cause of the error from sbomgen saying this image is a "non-linux container."

**Additional context**
Besides ECR Enhanced Scanning, this type of base image should be supported within ECR Basic Scanning as well.
Furthermore, a big shout out to Marrick from AWS team Sydney, how help us to identify this issue!

Start by reviewing the ECR Enhanced Scanning and Inspector behavior described here, then reproduce the unsupported result with a scratch- or busybox-based image such as quay.io/prometheus/busybox. Compare sbomgen's failure and the absence of /etc/os-release with the linked Dockerfiles; done means ECR scanning accepts the image and reports applicable findings rather than UNSUPPORTED_IMAGE.

Written by the indexing model from the issue text.