fix(linux): add logic to parse the upstream package name

Nobody has claimed this yet.

Why?
Many Linux distributions (debian/alpine/mariner) publish CVE data against source package names only, so this is required for users to CVE check against the output of component-detection.

Note: Syft doesn't always provide the source package name (it doesn't appear to provide this for ubuntu packages when the source and binary package names are the same).

The package name does not always line up 100% with the upstream or source name. For example some Linux distributions suffix the major version to differentiate i.e. python2 and python3. These should both be mapped back to python.

Initial code updates were introduced in these PRs: https://github.com/microsoft/component-detection/pull/88 https://github.com/microsoft/component-detection/pull/126

But they need to be revisited after becoming stale and having a large number of conflicts.

We will reintroduce a PR to resolve this issue once there is enough priority.

Start by reviewing the stale implementation attempts in PRs #88 and #126 and locating the current Linux package parsing entry point. Confirm how Debian, Alpine, and Mariner package names are represented, then define completion as mapping distribution source names—including version-suffixed names such as python2 and python3—to upstream names where possible, with coverage for cases where Syft omits a source name.

Written by the indexing model from the issue text.