Use single license scanner for all catalogers

[wagoodman]

Description

Extends work from #3290 by still not leveraging the static license change object (to prevent the GC from holding onto license classifier objects in static space) but also not creating the same scanner often (which results in poor CPU performance). Instead this approach uses a single scanner instance that is scoped to the context object created within the CreateSBOM() top-level API function. Since the licenses.Search() path is invoked several times, it's important to not create license scanner objects within that function, but instead, pass a new scanner object. This allows for the caller to swap strategies and provide configuration to get different behaviors in license scanning. That being said -- this configuration has NOT been exposed on the API, as the new licenses.Scanner is in an internal package, however, in the future we can elevate this to the pkg/license package and expose a new builder function on the top-level API CreateSBOMConfig, but this has been deferred until later.

• Addresses Java archive cataloger performance in 0.82.x much slower than 0.81.0 grype#2200

Type of change

• Bug fix (non-breaking change which fixes an issue)
• Performance (make Syft run faster or use less memory, without changing visible behavior much)

Checklist:

• I have added unit tests that cover changed behavior (updated existing tests)
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

[popey]

The fix is certainly comparable to the performance of the previous release.

for f in grype-0810 grype-0820 grype-0821 grype-fix; do time ./$f jenkins/jenkins:latest -o json=$f.json; done

grype v0.81.0

 ✔ Vulnerability DB                [no update available]
 ✔ Parsed image sha256:f78b5b90f20c751402aee62cca2342ed20abb9af0d06e45cdc666918ad9f9a00
 ✔ Cataloged contents 62fe8db1f064ce5bfd13cf87d2dcc9083d129b083a43009dde3551393ca9f4fa
   ├── ✔ Packages                        [497 packages]
   ├── ✔ File digests                    [8,512 files]
   ├── ✔ File metadata                   [8,512 locations]
   └── ✔ Executables                     [931 executables]
 ✔ Scanned for vulnerabilities     [156 vulnerability matches]
   ├── by severity: 4 critical, 15 high, 22 medium, 8 low, 92 negligible (15 unknown)
   └── by status:   13 fixed, 143 not-fixed, 0 ignored

real	0m55.700s
user	0m15.853s
sys	0m2.046s

grype v0.82.0

 ✔ Parsed image sha256:f78b5b90f20c751402aee62cca2342ed20abb9af0d06e45cdc666918ad9f9a00
 ✔ Cataloged contents 62fe8db1f064ce5bfd13cf87d2dcc9083d129b083a43009dde3551393ca9f4fa
   ├── ✔ Packages                        [497 packages]
   ├── ✔ File digests                    [8,878 files]
   ├── ✔ File metadata                   [8,878 locations]
   └── ✔ Executables                     [931 executables]
 ✔ Scanned for vulnerabilities     [156 vulnerability matches]
   ├── by severity: 4 critical, 15 high, 22 medium, 8 low, 92 negligible (15 unknown)
   └── by status:   13 fixed, 143 not-fixed, 0 ignored
[0058]  WARN unable to discover java packages from opener: unable to process nested java archive (WEB-INF/lib/javax.inject-1.jar): /usr/share/je
[0067]  WARN unable to parse cpe attributes for elf binary package error=unable to parse Attributes string: failed to parse Attributes="": wfn:

real	1m8.772s
user	0m52.209s
sys	0m2.892s

grype v0.82.1

 ✔ Parsed image sha256:f78b5b90f20c751402aee62cca2342ed20abb9af0d06e45cdc666918ad9f9a00
 ✔ Cataloged contents 62fe8db1f064ce5bfd13cf87d2dcc9083d129b083a43009dde3551393ca9f4fa
   ├── ✔ Packages                        [496 packages]
   ├── ✔ File digests                    [8,878 files]
   ├── ✔ File metadata                   [8,878 locations]
   └── ✔ Executables                     [931 executables]
 ✔ Scanned for vulnerabilities     [156 vulnerability matches]
   ├── by severity: 4 critical, 15 high, 22 medium, 8 low, 92 negligible (15 unknown)
   └── by status:   13 fixed, 143 not-fixed, 0 ignored
[0071]  WARN unable to discover java packages from opener: unable to process nested java archive (WEB-INF/lib/javax.inject-1.jar): /usr/share/je

real	1m28.341s
user	0m54.368s
sys	0m3.399s

grype fix - pr 3348

 ✔ Parsed image sha256:f78b5b90f20c751402aee62cca2342ed20abb9af0d06e45cdc666918ad9f9a00
 ✔ Cataloged contents 62fe8db1f064ce5bfd13cf87d2dcc9083d129b083a43009dde3551393ca9f4fa
   ├── ✔ Packages                        [496 packages]
   ├── ✔ File digests                    [8,878 files]
   ├── ✔ File metadata                   [8,878 locations]
   └── ✔ Executables                     [931 executables]
 ✔ Scanned for vulnerabilities     [156 vulnerability matches]
   ├── by severity: 4 critical, 15 high, 22 medium, 8 low, 92 negligible (15 unknown)
   └── by status:   13 fixed, 143 not-fixed, 0 ignored
[0053]  WARN unable to discover java packages from opener: unable to process nested java archive (WEB-INF/lib/javax.inject-1.jar): /usr/share/je

real	0m55.420s
user	0m17.839s
sys	0m2.131s