Allow for stubbing unknown versions over dropping packages

[wagoodman]

Today when we cannot find a version for a pacakge, we end up not including it in the SBOM at all. This is consistent with the NTIA minimum requirements, however, there is another option we have: we could stub version values with UNKNOWN_VERSION in these cases.

Ideally this behavior should be opt-in (drop packages by default), allowing a user to specify something like SYFT_PACKAGE_STUB_UNKONWN_VERSIONS=true (or something similar).

(this has come up in a few different offline conversations over the last few months, so figured I'd create an issue for it)

[GijsCalis]

At least for cyclonedx-json SBOM's quite a lot of java packages without versions are being included in the output file. Is that a bug in the java cataloger?