feat: use originator logic to fill supplier

[spiffcs]

Summary

Syft should be filling in the supplier information to meet NTIA minimum standards for SPDX sbom generated by the tool.

Partially Addressing #1961

There are additional refinements we can make where supplier can get it's own function when we determine a good fence for when one field should specify one value vs another:

A good example:

The SPDX document identifies the package as [glibc](https://www.gnu.org/software/libc/) 
and the Package Supplier as [Red Hat](https://www.redhat.com/), 
but the [Free Software Foundation](http://www.fsf.org/) is the Package Originator.

Supplier

Identify the actual distribution source for the package/directory identified in the SPDX document. 
This might or might not be different from the originating distribution source for the package. 
The name of the Package Supplier shall be an organization or recognized author and not a web site.

Originator

If the package identified in the SPDX document originated from a different person or organization than identified as Package Supplier (see [7.5](https://spdx.github.io/spdx-spec/v2-draft/package-information/#7.5) above)

This field identifies from where or whom the package originally came. 
In some cases, a package may be created and originally distributed by a different third party than the Package Supplier of the package.

In this case NOASSERTION is returned when:

the SPDX document creator has attempted to but cannot reach a reasonable objective determination

[github-actions]

Benchmark Test Results

Benchmark results from the latest changes vs base branch

goos: linux%0Agoarch: amd64%0Apkg: github.com/anchore/syft/test/integration%0Acpu: Intel(R) Xeon(R) Platinum 8171M CPU @ 2.60GHz%0A                                                              │ ./.tmp/benchmark-367f914.txt │%0A                                                              │            sec/op            │%0AImagePackageCatalogers/alpmdb-cataloger-2                                       14.08m ±  2%25%0AImagePackageCatalogers/apkdb-cataloger-2                                        827.1µ ±  1%25%0AImagePackageCatalogers/binary-cataloger-2                                       232.6µ ±  2%25%0AImagePackageCatalogers/dpkgdb-cataloger-2                                       693.1µ ±  3%25%0AImagePackageCatalogers/dotnet-portable-executable-cataloger-2                   25.92µ ±  4%25%0AImagePackageCatalogers/go-module-binary-cataloger-2                             106.2µ ±  6%25%0AImagePackageCatalogers/java-cataloger-2                                         16.26m ±  4%25%0AImagePackageCatalogers/graalvm-native-image-cataloger-2                         103.8µ ±  3%25%0AImagePackageCatalogers/javascript-package-cataloger-2                           442.0µ ±  2%25%0AImagePackageCatalogers/nix-store-cataloger-2                                    322.1µ ±  3%25%0AImagePackageCatalogers/php-composer-installed-cataloger-2                       941.5µ ±  3%25%0AImagePackageCatalogers/portage-cataloger-2                                      589.3µ ± 14%25%0AImagePackageCatalogers/python-package-cataloger-2                               3.899m ±  4%25%0AImagePackageCatalogers/r-package-cataloger-2                                    238.8µ ±  2%25%0AImagePackageCatalogers/rpm-db-cataloger-2                                       632.4µ ±  2%25%0AImagePackageCatalogers/ruby-gemspec-cataloger-2                                 1.073m ±  1%25%0AImagePackageCatalogers/sbom-cataloger-2                                         136.4µ ±  1%25%0Ageomean                                                                         564.1µ%0A%0A                                                              │ ./.tmp/benchmark-367f914.txt │%0A                                                              │             B/op             │%0AImagePackageCatalogers/alpmdb-cataloger-2                                       5.119Mi ± 0%25%0AImagePackageCatalogers/apkdb-cataloger-2                                        204.8Ki ± 0%25%0AImagePackageCatalogers/binary-cataloger-2                                       30.23Ki ± 0%25%0AImagePackageCatalogers/dpkgdb-cataloger-2                                       168.9Ki ± 0%25%0AImagePackageCatalogers/dotnet-portable-executable-cataloger-2                   3.696Ki ± 0%25%0AImagePackageCatalogers/go-module-binary-cataloger-2                             9.906Ki ± 0%25%0AImagePackageCatalogers/java-cataloger-2                                         2.840Mi ± 0%25%0AImagePackageCatalogers/graalvm-native-image-cataloger-2                         8.594Ki ± 0%25%0AImagePackageCatalogers/javascript-package-cataloger-2                           94.26Ki ± 0%25%0AImagePackageCatalogers/nix-store-cataloger-2                                    49.14Ki ± 0%25%0AImagePackageCatalogers/php-composer-installed-cataloger-2                       186.8Ki ± 0%25%0AImagePackageCatalogers/portage-cataloger-2                                      119.9Ki ± 0%25%0AImagePackageCatalogers/python-package-cataloger-2                               1.003Mi ± 0%25%0AImagePackageCatalogers/r-package-cataloger-2                                    53.30Ki ± 0%25%0AImagePackageCatalogers/rpm-db-cataloger-2                                       180.9Ki ± 0%25%0AImagePackageCatalogers/ruby-gemspec-cataloger-2                                 144.0Ki ± 0%25%0AImagePackageCatalogers/sbom-cataloger-2                                         14.20Ki ± 0%25%0Ageomean                                                                         100.3Ki%0A%0A                                                              │ ./.tmp/benchmark-367f914.txt │%0A                                                              │          allocs/op           │%0AImagePackageCatalogers/alpmdb-cataloger-2                                        87.74k ± 0%25%0AImagePackageCatalogers/apkdb-cataloger-2                                         4.181k ± 0%25%0AImagePackageCatalogers/binary-cataloger-2                                         830.0 ± 0%25%0AImagePackageCatalogers/dpkgdb-cataloger-2                                        3.002k ± 0%25%0AImagePackageCatalogers/dotnet-portable-executable-cataloger-2                     132.0 ± 0%25%0AImagePackageCatalogers/go-module-binary-cataloger-2                               281.0 ± 0%25%0AImagePackageCatalogers/java-cataloger-2                                          40.19k ± 0%25%0AImagePackageCatalogers/graalvm-native-image-cataloger-2                           228.0 ± 0%25%0AImagePackageCatalogers/javascript-package-cataloger-2                            1.342k ± 0%25%0AImagePackageCatalogers/nix-store-cataloger-2                                      895.0 ± 0%25%0AImagePackageCatalogers/php-composer-installed-cataloger-2                        4.079k ± 0%25%0AImagePackageCatalogers/portage-cataloger-2                                       2.268k ± 0%25%0AImagePackageCatalogers/python-package-cataloger-2                                16.44k ± 0%25%0AImagePackageCatalogers/r-package-cataloger-2                                      929.0 ± 0%25%0AImagePackageCatalogers/rpm-db-cataloger-2                                        3.989k ± 0%25%0AImagePackageCatalogers/ruby-gemspec-cataloger-2                                  2.447k ± 0%25%0AImagePackageCatalogers/sbom-cataloger-2                                           394.0 ± 0%25%0Ageomean                                                                          2.052k

[spiffcs]

Update the root package to have supplier as noassertion since this is a manually synthesized package as part of the source object

[wagoodman]

was this updated intentionally?

[kzantow]

👍 -- per discussion, just add a NOASSERTION supplier to the root package