fix: pass image reference to syft sbom source object

[lucasrod16]

Description

When creating an image SBOM with syft, we currently pass an empty string "" to NewFromStereoscopeImageObject when creating a new image source object.

source.NewFromStereoscopeImageObject(syftImage, "", nil)

The second argument is the image reference. This data is ultimately used to populate the source metadata in the final SBOM, but since we pass an empty string, the userInput field is empty.

The fix is to pass in the image reference so that the userInput field is populated in the final SBOM.

source.NewFromStereoscopeImageObject(syftImage, ref, nil)

Steps to reproduce:

1. Create this package

   kind: ZarfPackageConfig
   metadata:
     name: sbom-test
     architecture: amd64
   components:
     - name: sbom-test
       required: true
       images:
         - quay.io/minio/minio:RELEASE.2024-03-21T23-13-43Z

2. Extract the package

   zarf tools archiver decompress zarf-package-sbom-test-amd64.tar.zst sbom

3. Extract the sbom tarball

   zarf tools archiver decompress sbom/sboms.tar sbom/syft 

4. Check the .source.metadata.userInput field in the image SBOM

   cat sbom/syft/quay.io_minio_minio_RELEASE.2024-03-21T23-13-43Z.json | jq .source.metadata.userInput

   With current Zarf, you will see that it returns an empty string. Re-run all of the above steps with Zarf built from this PR branch, and you will see it returns the image reference quay.io/minio/minio:RELEASE.2024-03-21T23-13-43Z

5. Generate a vulnerability scan report with grype

   cat sbom/syft/quay.io_minio_minio_RELEASE.2024-03-21T23-13-43Z.json | grype -o sarif > zarf-scan.json 

   You will see that the generated report is missing the image reference in the output

   "text": "A medium vulnerability in go-module package: gopkg.in/square/go-jose.v2, version v2.6.0 was found in image at: /usr/bin/minio"

   Re-run all of the above steps with Zarf built from this PR branch, and you will see the image reference in the generated report:

   "text": "A medium vulnerability in go-module package: gopkg.in/square/go-jose.v2, version v2.6.0 was found in image quay.io/minio/minio:RELEASE.2024-03-21T23-13-43Z at: /usr/bin/minio"

Related Issue

Fixes #2608

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide Steps followed

[netlify]

✅ Deploy Preview for zarf-docs canceled.

Name	Link
🔨 Latest commit	7c2bc53
🔍 Latest deploy log	https://app.netlify.com/sites/zarf-docs/deploys/666895834197570008ee6e2e