Account for maven bundle plugin and fix filename matching

[wagoodman]

This PR makes a few changes to the java archive cataloger:

• takes into account the maven bundle plugin, which is common tooling that we can key off of patterns from the Bundle-SymbolicName field to get a group ID and artifact ID. Then we can extract the artifact ID as the package name.
• If a filename looks like a group ID + artifact ID, attempt to parse it as such and extract the artifact ID as the package name.
• When attempting to find if a pom.xml matches with an existing package, allow for the artifact ID to be a suffix of the filename (not just the filename as a prefix of the artifact ID as it is today)

Blocked until the following are verified:

• CPE generation logic can additionally consider the new sources of information when crafting a vendor (I think this is done, but need to double check)
• purl generation is using the right group ID found (again, I think this is done, but need to check)
• incorporate locally into grype and run against the quality gate -- are we better or worse off on the whole? Incorporate Syft java detection improvements grype#1555

Closes #2217
Fixes #2130

[spiffcs]

LGTM - thanks for carving out this path to get a better artifact ID and the subsequent groupID changes. The examples were really easy to follow and the testing added is really clear.

I had a questions about the following:

When attempting to find if a pom.xml matches with an existing package, allow for the artifact ID to be a suffix of the filename (not just the filename as a prefix of the artifact ID as it is today)

Memory: I thought we had experimented with this in the past and found it surfaced too many incorrect pom.xml. Basically, suffix checks were too lose and the naming conventions in java were too broad to allow this kind of pom to be checked. Yes we might miss some things where this case exists, but limiting the data here was correct in that we were not getting more wrong hits than correct hits.

What was the trigger for making this change?

[spiffcs]

+1 to untangle this many thanks

[spiffcs]

Ahh - I'll fix the merge commit - apologies

[wagoodman]

@spiffcs

What was the trigger for making this change?

Essentially it was from taking a closer look at some of the artifacts referenced in the attached issues.

I thought we had experimented with this in the past and found it surfaced too many incorrect pom.xml

I can't recall the specifics of what was experimented on from 3-ish months ago, but this seems different than the original implementation from about a year ago.