fix(sbom): use package UIDs for uniqueness

[knqyf263]

Description

The package ID, based on the name and version, is used in some places.

trivy/pkg/sbom/io/encode.go

Line 177 in 137c916

vulns[v.PkgID] = append(vulns[v.PkgID], v)

However, it is not globally unique, as there are cases where the same package is installed in different paths. We should use UIDs for this purpose.

Also, added a process to fill in the UIDs for old JSON reports as they don't contain UIDs, and tests for trivy convert.

Related issues

• Close bug(cyclonedx): Trivy image scan reports and counts the same CVE for the same package multiple times #5796

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).