Fix decoding package groups from cyclonedx sboms

[wagoodman]

This PR is work extracted from #1029 specifically relating to comment #1029 (comment) from @wurstbrot (cc: @patrikbeno). This fixes the decoding of cyclonedx packages to account for information that may be stored in the group attribute. However, what work has not been completed yet is considering how that should affect the encoding of a package into the group attribute. Without this we cannot pass the encode-decode-encode integration test that attempts to prove stability in our encoding and decoding methods.

[github-actions]

Benchmark Test Results

Benchmark results from the latest changes vs base branch

name                                                       old time/op    new time/op    delta
ImagePackageCatalogers/alpmdb-cataloger-2                    11.6ms ± 0%    11.6ms ± 0%    ~     (p=0.190 n=5+4)
ImagePackageCatalogers/ruby-gemspec-cataloger-2              1.36ms ± 9%    1.30ms ± 1%  -4.09%  (p=0.016 n=5+5)
ImagePackageCatalogers/python-package-cataloger-2            3.35ms ± 1%    3.28ms ± 0%  -1.82%  (p=0.008 n=5+5)
ImagePackageCatalogers/php-composer-installed-cataloger-2    1.09ms ± 2%    1.08ms ± 1%    ~     (p=0.222 n=5+5)
ImagePackageCatalogers/javascript-package-cataloger-2         763µs ± 0%     759µs ± 0%    ~     (p=0.095 n=5+5)
ImagePackageCatalogers/node-binary-cataloger-2               6.87µs ± 1%    6.80µs ± 2%    ~     (p=0.095 n=5+5)
ImagePackageCatalogers/dpkgdb-cataloger-2                     876µs ± 0%     872µs ± 1%    ~     (p=0.310 n=5+5)
ImagePackageCatalogers/rpm-db-cataloger-2                    1.30ms ± 0%    1.28ms ± 1%  -2.00%  (p=0.008 n=5+5)
ImagePackageCatalogers/java-cataloger-2                      14.5ms ± 1%    14.6ms ± 1%    ~     (p=0.151 n=5+5)
ImagePackageCatalogers/apkdb-cataloger-2                     1.31ms ± 3%    1.31ms ± 2%    ~     (p=0.421 n=5+5)
ImagePackageCatalogers/go-module-binary-cataloger-2          6.80µs ± 1%    6.80µs ± 1%    ~     (p=0.690 n=5+5)
ImagePackageCatalogers/dotnet-deps-cataloger-2               1.37ms ± 1%    1.37ms ± 0%    ~     (p=0.690 n=5+5)
ImagePackageCatalogers/portage-cataloger-2                    726µs ± 1%     723µs ± 1%    ~     (p=0.222 n=5+5)

name                                                       old alloc/op   new alloc/op   delta
ImagePackageCatalogers/alpmdb-cataloger-2                    5.26MB ± 0%    5.26MB ± 0%    ~     (p=0.548 n=5+5)
ImagePackageCatalogers/ruby-gemspec-cataloger-2               205kB ± 0%     205kB ± 0%    ~     (p=0.548 n=5+5)
ImagePackageCatalogers/python-package-cataloger-2             962kB ± 0%     961kB ± 0%    ~     (p=0.151 n=5+5)
ImagePackageCatalogers/php-composer-installed-cataloger-2     217kB ± 0%     217kB ± 0%    ~     (p=0.222 n=5+5)
ImagePackageCatalogers/javascript-package-cataloger-2         159kB ± 0%     159kB ± 0%    ~     (p=0.690 n=5+5)
ImagePackageCatalogers/node-binary-cataloger-2               1.12kB ± 0%    1.12kB ± 0%    ~     (all equal)
ImagePackageCatalogers/dpkgdb-cataloger-2                     199kB ± 0%     199kB ± 0%    ~     (p=0.056 n=5+5)
ImagePackageCatalogers/rpm-db-cataloger-2                     303kB ± 0%     303kB ± 0%    ~     (p=0.151 n=5+5)
ImagePackageCatalogers/java-cataloger-2                      3.49MB ± 0%    3.49MB ± 0%    ~     (p=0.841 n=5+5)
ImagePackageCatalogers/apkdb-cataloger-2                     1.26MB ± 0%    1.26MB ± 0%    ~     (p=0.738 n=5+5)
ImagePackageCatalogers/go-module-binary-cataloger-2          1.12kB ± 0%    1.12kB ± 0%    ~     (all equal)
ImagePackageCatalogers/dotnet-deps-cataloger-2                374kB ± 0%     374kB ± 0%  -0.06%  (p=0.008 n=5+5)
ImagePackageCatalogers/portage-cataloger-2                    139kB ± 0%     139kB ± 0%    ~     (p=0.548 n=5+5)

name                                                       old allocs/op  new allocs/op  delta
ImagePackageCatalogers/alpmdb-cataloger-2                     85.7k ± 0%     85.7k ± 0%    ~     (p=0.444 n=5+5)
ImagePackageCatalogers/ruby-gemspec-cataloger-2               4.24k ± 0%     4.24k ± 0%    ~     (all equal)
ImagePackageCatalogers/python-package-cataloger-2             16.5k ± 0%     16.5k ± 0%    ~     (p=0.492 n=5+5)
ImagePackageCatalogers/php-composer-installed-cataloger-2     5.50k ± 0%     5.50k ± 0%    ~     (p=0.881 n=5+5)
ImagePackageCatalogers/javascript-package-cataloger-2         3.33k ± 0%     3.33k ± 0%    ~     (all equal)
ImagePackageCatalogers/node-binary-cataloger-2                 38.0 ± 0%      38.0 ± 0%    ~     (all equal)
ImagePackageCatalogers/dpkgdb-cataloger-2                     4.46k ± 0%     4.46k ± 0%    ~     (all equal)
ImagePackageCatalogers/rpm-db-cataloger-2                     8.11k ± 0%     8.11k ± 0%    ~     (all equal)
ImagePackageCatalogers/java-cataloger-2                       57.5k ± 0%     57.5k ± 0%    ~     (p=0.587 n=5+5)
ImagePackageCatalogers/apkdb-cataloger-2                      5.45k ± 0%     5.45k ± 0%    ~     (p=0.444 n=5+5)
ImagePackageCatalogers/go-module-binary-cataloger-2            38.0 ± 0%      38.0 ± 0%    ~     (all equal)
ImagePackageCatalogers/dotnet-deps-cataloger-2                7.12k ± 0%     7.12k ± 0%    ~     (all equal)
ImagePackageCatalogers/portage-cataloger-2                    3.58k ± 0%     3.58k ± 0%    ~     (all equal)

[spiffcs]

I'll update the conflicts, but notes here from sync review. We probably want to enhance the package struct with a FormatProperties attribute that can reserve these format specific values across encode and decode for spdx/cyclonedx. I'll give a quick stab at that and post it here for further review.