fix(alpine): add UID for removed packages

[DmitriyLewen]

Description

Packages found from image config should also contain UID.

These changes also fix a dependency issue for the BOM core (see #7886)
e.g. for CycloneDX:

before:

➜ trivy -q image -f cyclonedx  node:22.11-alpine --removed-pkgs
...
      "ref": "8a1b0f78-6da7-4567-abd3-3d36951588bc",
      "dependsOn": [
        "678d2ae9-d409-4e33-bc1b-7304560ac75a",
        "678d2ae9-d409-4e33-bc1b-7304560ac75a",
        "678d2ae9-d409-4e33-bc1b-7304560ac75a",
...

after:

➜  ./trivy -q image -f cyclonedx  node:22.11-alpine --removed-pkgs

...
      "ref": "b6ada0a0-4305-40bd-a0f4-444bac8ec868",
      "dependsOn": [
        "037012ad-0b78-470d-80d0-efbc1b1a49f7",
        "05852c2e-b9f5-47d2-a54f-23801023974f",
        "076700ec-c73b-48a5-9b03-9ae03a9b2b00",

Related issues

• Close bug(os): apline removed packages don't have UID #7886

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).