feat(ruby): emit dependency relationships from Gemfile.lock

[cgreeno]

Description

The Ruby Gemfile.lock parser catalogued gems but discarded the indented dependency lines beneath each spec, so it emitted no relationships. Those lines already encode the dependency graph (the gems listed under each spec are exactly its dependencies), so the graph is derivable from data already in the file — no new inputs required.

This change emits dependency-of relationships between locked gems. They are built inline in the parser, the way cpp/conan and dotnet derive relationships from their lockfiles — Gemfile.lock packages carry no metadata struct, so there is nothing to hang a dependency.Specifier off, and a relationships-only change needs no metadata type. No new metadata type and no JSON schema change.

Changeset:

File	Change
syft/pkg/cataloger/ruby/parse_gemfile_lock.go	gather each spec's indented dependency lines; emit dependency-of relationships (gemfileLockRelationships); split line detection into isGemSpecLine (4-space) and isGemDependencyLine (6-space)
parse_gemfile_lock_test.go	assert the full dependency graph over the existing real-world Gemfile.lock fixture
parse_gemfile_lock_relationships_test.go (new)	unit tests for the spec/dependency line detection and the relationship builder, including the unresolved-dependency skip path

Type of change: New feature (non-breaking) — adds relationship data without altering existing package output; no schema impact.

This mirrors the Elixir mix.lock change in #4985.

[oss-housekeeper]

Schema Change Detection

New Schemas

• schema/json/schema-16.1.9.json

[spiffcs]

@cgreeno since I merged your other elixir PR first this now has some schema conflicts. Can you do a quick rebase and regenerate the schema with the composite changes?

[cgreeno]

@spiffcs - ok fixed

[cgreeno]

@spiffcs - gentle nudge :)