Provide default sets of extractors for scanning in container vs source context

Currently, OSV-SCALIBR doesn't provide any defaults / distinction for the sets of extractors to enable in source vs context context.

For example, if all extractors were enabled, we'd potentially get false positive matches when scanning a container because we'd pick up source manifest files (e.g. package-lock.json) that aren't actually installed.

We should provide an easy way for users to select which context they're running in and the set of extractors that apply to that context.

The issue does not name specific files, tests, or entry points. Start by tracing how extractor sets are selected for scans, then determine how users can choose source versus container context and verify that each context enables only its intended extractors without producing false positives.

Written by the indexing model from the issue text.