fix: remove race when writing errors in generic cataloger

[wagoodman]

I'm seeing partial values referenced in the issue traceback and a nil dereference:

unexpected fault address 0x0
fatal error: fault
[0001] DEBUG discovered 0 packages cataloger=go-module-binary-cataloger
[signal SIGSEGV: segmentation violation code=0x80 addr=0x0 pc=0x123a0da]

goroutine 85 gp=0xc000cb36c0 m=21 mp=0xc000278008 [running]:
runtime.throw({0x1c6f462?, 0xb0efc6?})
        /opt/hostedtoolcache/go/1.24.2/x64/src/runtime/panic.go:1101 +0x48 fp=0xc002f29938 sp=0xc002f29908 pc=0x479ac8
runtime.sigpanic()
        /opt/hostedtoolcache/go/1.24.2/x64/src/runtime/signal_unix.go:939 +0x26c fp=0xc002f29998 sp=0xc002f29938 pc=0x47bbec
github.com/anchore/syft/internal/unknown.visitErrors({0x6168732f7273752f, 0x656e746f642f6572}, 0xc002f29d70)
        /home/runner/work/syft/syft/internal/unknown/coordinate_error.go:170 +0x3a fp=0xc002f29ad0 sp=0xc002f29998 pc=0x123a0da
github.com/anchore/syft/internal/unknown.visitErrors({0x22afe20, 0xc005a4f3e0}, 0xc002f29d70)
        /home/runner/work/syft/syft/internal/unknown/coordinate_error.go:173 +0xf8 fp=0xc002f29c08 sp=0xc002f29ad0 pc=0x123a198
github.com/anchore/syft/internal/unknown.visitErrors({0x22afe20, 0xc002d807b0}, 0xc002f29d70)
        /home/runner/work/syft/syft/internal/unknown/coordinate_error.go:173 +0xf8 fp=0xc002f29d40 sp=0xc002f29c08 pc=0x123a198
github.com/anchore/syft/internal/unknown.ExtractCoordinateErrors({0x22afe20?, 0xc002d807b0?})
        /home/runner/work/syft/syft/internal/unknown/coordinate_error.go:106 +0x47 fp=0xc002f29d90 sp=0xc002f29d40 pc=0x1239767
...

Which:

• github.com/anchore/syft/internal/unknown.visitErrors({0x6168732f7273752f, 0x656e746f642f6572}, 0xc002f29d70) when decoded appears to be entod/erahs/rsu/, when flipped /usr/share/dotne, I don't think I should be seeing partial values here
• based off of a code analysis of visitErrors, it seems that the address of the error after type assertion is assigned out of band to 0 (which would not be possible without multiple concurrent writers)

I think a reproduction without concurrent writers of this would be something akin to (but not exactly the same as what the traceback is):

func TestCorruptErrorSegfault(t *testing.T) {
	path := "/usr/share/dotnet"

	var err error
	strPtr := unsafe.Pointer(&path)
	errPtr := (*error)(unsafe.Pointer(&strPtr))
	err = *errPtr

	defer func() {
		if r := recover(); r != nil {
			t.Logf("Test recovered from panic: %v", r)
		}
	}()

	_, _ = ExtractCoordinateErrors(err)
}

The fix is to ensure that the errors being processed are only written within the Collect() closure, and not to a variable on the stack of the caller.

• Fixes Syft crash [signal SIGSEGV: segmentation violation code=0x80 addr=0x0 pc=0x123a0da] #3872

Type of change

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

[kzantow]

LGTM 👍 Thanks for jumping on this!