bug(os): apline removed packages don't have UID

[DmitriyLewen]

Description

Apline removed packages (--removed-pkgs flag) don't have UID:

➜ trivy -q image -f json --list-all-pkgs node:22.11-alpine --removed-pkgs | grep zstd-libs -A 5
          "Name": "zstd-libs",
          "Identifier": {},
          "Version": "1.5.6-r0",
          "Layer": {}
        }
      ],

For this reason we build incorrect dependency graph for SBOM formats:

    {
      "ref": "e51ad365-e7ee-4887-b9c4-ac9a4be4ab11", // OS component
      "dependsOn": [
        "7699e9b4-a6b9-4a75-a2d5-5aad7eecea98", // one of removed pkgs
        "7699e9b4-a6b9-4a75-a2d5-5aad7eecea98",
       ...
        "pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.20.3", // alpine pkgs
        "pkg:apk/alpine/[email protected]?arch=x86_64&distro=3.20.3",

Discussed in #7877