Docker scout has false positive on Ubuntu python packages

Given Dockerfile

FROM ubuntu:22.04

RUN apt-get update && apt-get install -y python3-cryptography

When I run

../.docker/scout/docker-scout  cves --only-cve-id CVE-2023-50782 --locations  scout-testing:latest

I get in the output:

## Packages and Vulnerabilities

   0C     1H     0M     0L  cryptography 3.4.8
pkg:pypi/cryptography@3.4.8

6: sha256:02345afc3af08ee5903273fe8ee825ce2611e764e3f31016f03eaaa6be7934bc
/usr/lib/python3/dist-packages/cryptography-3.4.8.egg-info/PKG-INFO (evident by)
/usr/lib/python3/dist-packages/cryptography-3.4.8.egg-info/top_level.txt (evident by)

    ✗ HIGH CVE-2023-50782 [Observable Discrepancy]
      https://scout.docker.com/v/CVE-2023-50782?s=github&n=cryptography&t=pypi&vr=%3C42.0.0
      Affected range : <42.0.0                                                          
      Fixed version  : 42.0.0                                                           
      CVSS Score     : 8.7                                                              
      CVSS Vector    : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N  
    


1 vulnerability found in 1 package
  CRITICAL  0  
  HIGH      1  
  MEDIUM    0  
  LOW       0 

Suggested fix: docker scout should map the egg-info directories to apt packages. If they have been installed via apt, they should not be detected as pypi installed packages.

Reproduce the report with the shown Dockerfile and the docker-scout cves command, then trace how the reported egg-info paths are classified. Done means the apt-installed cryptography package is mapped to its Ubuntu package and is not reported as a PyPI package, while the scan still identifies applicable vulnerabilities.