fix(sbom): don't overwrite srcEpoch when decoding SBOM files

[DmitriyLewen]

Description

Trivy stores source information in properties.
So, we only need to overwrite the source information if srcName and srcVersion are not found (it means that we decoding third-party SBOMs).

Related issues

• Close bug(bom): overwrite epoch if srcEpoch is 0 #6865

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

What if returning boolean from parseSrcVersion? It returns true if we update the source package.

[DmitriyLewen]

we can't use parseSrcVersion. c.SrcVersion is empty for cyclonedx, because we inserted source info from properties to pkg:

trivy/pkg/sbom/io/decode.go

Lines 210 to 219 in e8d8af4

	case core.PropertySrcName:
	pkg.SrcName = prop.Value
	case core.PropertySrcVersion:
	pkg.SrcVersion = prop.Value
	case core.PropertySrcRelease:
	pkg.SrcRelease = prop.Value
	case core.PropertySrcEpoch:
	if pkg.SrcEpoch, err = strconv.Atoi(prop.Value); err != nil {
	return nil, xerrors.Errorf("invalid src epoch: %w", err)
	}

[knqyf263]

@aqua-bot backport release/v0.52

[aqua-bot]

Backport PR created: #6881