feat: add --distro flag to manually specify OS distribution for vulnerability scanning

[knqyf263]

Background

Currently, Trivy automatically detects the OS during container image scanning and performs vulnerability detection based on that OS. However, there are use cases where manual OS specification would be beneficial.

Use Cases

1. When scanning for vulnerabilities against a different OS version than the installed one

Some patches might be available in different versions but not in the current version like this case.

Example:

$ trivy image --distro alpine/edge alpine:3.20

2. When OS detection fails

Some images remove /etc/os-release for size optimization.

Example:

$ trivy image --distro debian/11 my-distroless

3. When scanning non-container artifacts

RPM archive scanning doesn't provide OS information.

Example:

$ trivy fs --distro redhat/9 ./rpms/

Proposal

Add a new --distro flag to manually specify OS information. When this flag is provided, it will override any automatically detected OS information.

Expected Format

--distro <family>/<version>

Implementation Notes

• The flag should override any auto-detected OS information
• Support for major Linux distributions (Alpine, Debian, RedHat, etc.)
• Clear documentation on supported distribution formats

Discussed in #8056