feat: catalog CPAN distributions installed by perl clients

[wagoodman]

Adds a cataloger for CPAN distributions installed by perl clients, along with a new perl language and cpan package type.

Two catalogers:

• perl-cpan-installed-cataloger: reads .meta/*/install.json (cpanm, cpm, carton) and auto/**/.packlist (ExtUtils::MakeMaker, Module::Build, CPAN.pm). Covers system installs, local-lib, and carton trees.
• perl-cpan-meta-cataloger: reads META.json / META.yml from unpacked releases. Only directories with a sibling MANIFEST are considered, which excludes source checkouts.

Output:

• packages are keyed on the distribution (e.g. libwww-perl), not the module (LWP), since that is what CPAN and advisory data use
• purl is pkg:cpan/<distribution>@<version>, with an author qualifier when the PAUSE author is known
• new metadata types: cpan-distribution (installed) and cpan-unpacked-release (release on disk)
• packlist file paths are reported as owned files, unfiltered
• JSON schema bumped to 16.1.11

Version resolution for packlists:

• read from perllocal.pod first, matching on module name and the longest installed into libdir that prefixes the packlist path (so a second perl on the image doesn't supply the version)
• falls back to scraping $VERSION from the main .pm, including package Foo v1.0.0;, $Foo::Bar::VERSION, and qv() forms
• runtime-computed versions are not evaluated; those packages are reported with no version

Worth knowing:

• a distribution can show up twice at different versions. e.g. libwww-perl 5.836 bundles and overwrites HTTP-Message and friends, so both versions really are on disk
• build leftovers under ~/.cpanm/work and ~/.cpan/build are skipped, otherwise every distribution on an uncleaned image would be reported twice
• META.yml is supported since ~43% of CPAN releases ship without META.json. Unparseable META.yml files are skipped, not fatal

Not covered:

• modules installed via distro packages (deb/rpm/apk already report these)
• core and dual-life modules bundled with the interpreter
• vendored trees, App::FatPacker output, and PAR archives

Closes #1906 (only for cpan, not ppm)

[oss-housekeeper]

Schema Change Detection

New Schemas

• schema/json/schema-16.1.11.json

[willmurphyscode]

I think there's still a small version handling bug:

CPAN distributions are reported under their distvname (and sometimes duplicated)

distributionName (parse_install_json.go:66-80) takes the package name from install.json by trimming "-" + version off dist. But cpanm doesn't write the same version into both fields:

• dist is the release's distvname.
• version is the main module's $VERSION.

cpanm's save_meta writes version => $provides->{$module_name}{version} || $dist->{version} (source: Menlo/CLI/Compat.pm, which cpanm 1.7 is built from). When the two strings differ, the trim fails and the whole distvname becomes the package name. The comment on that fallback says no installer writes such a record, but cpanm does.

This isn't rare. 3,573 distributions in PAUSE's current 02packages index have a main-module version string that differs from the release version, mostly in format only (2.9.0 vs 2.009000). That still breaks an exact-string trim. TRIAL releases always hit it.

FROM perl:5.40-slim

# TRIAL release: dist=Try-Tiny-0.26-TRIAL, version=0.26. Dropped from the live mirrors, so fetch it
# from backpan; a PAUSE path through a mirror is what makes cpanm write install.json.
RUN cpanm --notest --mirror https://backpan.perl.org --mirror-only E/ET/ETHER/Try-Tiny-0.26-TRIAL.tar.gz

# same number written two ways: dist=Carp-Assert-More-2.9.0, version=2.009000
RUN cpanm --notest P/PE/PETDANCE/Carp-Assert-More-2.9.0.tar.gz

# different numbers: dist=Class-Rebirth-1.003, version=1.000
RUN cpanm --notest A/AH/AHERNIT/Class-Rebirth-1.003.tar.gz

$ docker build -t cpan-distvname-repro .
$ go run ./cmd/syft docker:cpan-distvname-repro --select-catalogers perl -q
NAME                    VERSION   TYPE
App-cpanminus           1.7049    cpan    # from the base image
Carp-Assert-More        2.9.0     cpan    # correct (.packlist + perllocal.pod)
Carp-Assert-More-2.9.0  2.009000  cpan    # duplicate of the line above, with the distvname as its name (install.json)
Class-Rebirth           1.003     cpan    # correct (.packlist + perllocal.pod)
Class-Rebirth-1.003     1.000     cpan    # duplicate of the line above, with the distvname as its name (install.json)
Exporter-Tiny           1.006003  cpan    # dependency of List-MoreUtils
IO-Socket-SSL           2.099     cpan    # from the base image
List-MoreUtils          0.430     cpan    # dependency of Class-Rebirth
Net-SSLeay              1.96      cpan    # from the base image
Try-Tiny-0.26-TRIAL     0.26      cpan    # should be Try-Tiny; no duplicate because both records said 0.26 and merged

The ordinary releases are duplicated because the packlist record gets the release version, the install.json record gets the module version, and the merge won't pair records whose versions disagree. MetaCPAN names that release distribution: Try-Tiny, version: 0.26, maturity: developer (API): -TRIAL is a maturity flag, not part of the name.

Suggested fix: take both name and version from dist. Split at the last - followed by v?\d and drop -TRIAL, as CPAN::DistnameInfo does. Existing cases keep working (libwww-perl-6.83 → libwww-perl, CPAN-02Packages-Search-v1.0.0 → CPAN-02Packages-Search), and the install.json and packlist records then agree and merge into one package.