feat: add Hadron Linux support

[Itxaka]

Description

Adds support for Hadron Linux to Syft.

Hadron Linux is a musl-based, rolling-release distribution that ships pristine upstream package versions and has no traditional package manager. Installed component versions are recorded in a single flat JSON file at /usr/lib/hadron/components.json (a name → version map).

This PR adds:

• A new package type pkg.HadronPkg ("hadron"), with PackageURLType() returning hadron so packages are minted as pkg:hadron/<name>@<version>.
• A new hadron-cataloger (a generic cataloger) that parses **/usr/lib/hadron/components.json, emitting one OS package per entry. Empty name/version rows are skipped and output is sorted by name for deterministic results.
• Registration of the cataloger in the OS installed-package task group.
• SPDX SourceInfo mapping for the new type.
• Capabilities data for the new cataloger.

OS detection works out of the box: ID=hadron in os-release flows through linux.Release and is surfaced as distro hadron.

PURL

pkg:hadron/<name>@<version> — chosen to reconcile 1:1 with the corresponding Trivy implementation (Trivy mints the OS-package PURL type from the OS family string, i.e. hadron).

Context

This is the Syft half of cross-tool Hadron support. It mirrors the Trivy implementation in aquasecurity/trivy#10901 so that an SBOM/scan of the same Hadron image yields identical package names, versions, IDs, OS family, and PURLs regardless of scanner. A companion Grype change adds the hadron distro type and a distro matcher.

No vulnerability advisory source for Hadron exists yet; that is intentionally out of scope here.

Type of change

• New feature (non-breaking change which adds functionality)