feat(alpine): support apk repositories

[knqyf263]

Description

Try to take the Alpine version from /etc/apk/repositories. It allows to scan distroless images based on Alpine.

$ trivy image ghcr.io/distroless/git
2022-04-13T18:43:16.352+0300    INFO    Detected OS: alpine
2022-04-13T18:43:16.352+0300    INFO    Detecting Alpine vulnerabilities...
2022-04-13T18:43:16.354+0300    INFO    Number of language-specific files: 1
2022-04-13T18:43:16.354+0300    INFO    Detecting gobinary vulnerabilities...

ghcr.io/distroless/git (alpine edge)
====================================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

+---------+------------------+----------+-------------------+---------------+---------------------------------------+
| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                 TITLE                 |
+---------+------------------+----------+-------------------+---------------+---------------------------------------+
| git     | CVE-2022-24765   | MEDIUM   | 2.35.1-r2         | 2.35.2-r0     | Git for Windows is a                  |
|         |                  |          |                   |               | fork of Git containing                |
|         |                  |          |                   |               | Windows-specific patches. ...         |
|         |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2022-24765 |
+---------+------------------+----------+-------------------+---------------+---------------------------------------+

...

Related issues

• Close trivy fails to scan apk-based containers without /etc/os-release matching alpine #1975
• [WIP] Add trivy scanning to release workflows. chainguard-images/template#9

Related PRs

• feat(alpine): add parsing /etc/apk/repositories file to get OS version  fanal#462
• Add Alpine distroless trivy-test-images#14

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).