Cataloger filtering cross matches wrong catalogers

[cdupuis]

Adding the following test to https://github.com/anchore/syft/blob/main/syft/pkg/cataloger/cataloger_test.go#L27 shows that when requesting only java-cataloger, the javascript-package-cataloger and javascript-lock-cataloger are both enabled, which IMHO is wrong.

                {
			name: "don't cross match",
			patterns: []string{
				"java-cataloger",
			},
			catalogers: []string{
				"javascript-package-cataloger",
				"java-cataloger",
			},
			want: []string{
				"java-cataloger",
			},
		},

[wagoodman]

Entirely agreed -- this is not correct behavior. We could change the behavior to require matching exactly (instead of contains) or make hard coded exceptions (not ideal, but could be a fine workaround for now if we wanted something quick that didn't break existing behavior).

Additionally there is a PR that we're looking to get in that would change this behavior for the better #1383 (specifically at https://github.com/anchore/syft/pull/1383/files#diff-e7cb9915335df0e3ab997cf8a7b0574e4a0ecc5dc8db5a9e6ed8ba28eccb325b). The cataloger selection is more explicit and doesn't rely on the contains approach as done now.

[wagoodman]

I've additionally opened up #1578 to capture the fact that this cataloger name is not specific enough for what it does.