PRP: Extractor for Haskell Cabal Package Manager

- **Software distribution method or binary type**:
Information about each installed package and their dependencies through `cabal` are stored as `.conf` files under:
`~/.local/state/cabal/store/ghc-9.10.3-inplace/package.db/` (Unix-based OSs)
`%APPDATA%\cabal\store\ghc-9.10.3-inplace\package.db\` (Windows)
For example, `~/.local/state/cabal/store/ghc-9.10.3-inplace/package.db/OneTuple-0.4.3-927e3bd783bb74bce419a0fd3fbacaee6f7e34fdc740b02bb39e009857b9a1f3.conf`

- **Popularity of distribution method**
Cabal is the official and foundational package/build system of the Haskell ecosystem and is used by the vast majority of Haskell libraries published on Hackage. Hackage has hosted packages since 2007 and now indexes Millions of packages along with 100s of GBs of package metadata and archives, making Cabal the dominant low-level tooling standard in the ecosystem.

- **Any critical, emergent vulnerability associated with software from the distribution method**:
`hackage-server` affected by `CVE-2026-40472` (CVE Rating *9.9*). Here's a direct link to the [osv.dev entry](https://osv.dev/vulnerability/HSEC-2026-0004) for the mentioned vulnerability.

- **Gap Coverage**
As of today, osv-scalibr can only parse `cabal.project.freeze` for dependency extraction. However, the `cabal.project.freeze` file only list dependencies for the current project, not system-wide. e.g, it doesn't include every package installed through `cabal` package manager.

- **Resources**:
* [Cabal Homepage](https://www.haskell.org/cabal/)
* [OSV DEV Hackage Ecosystem](https://osv.dev/list?ecosystem=Hackage)